ci.yml

name: Build and push image

on:
  push:
  pull_request:
    branches: ["master"]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}
  # supported build archs
  ARCHS: x86_64 aarch64

jobs:

  linux_test:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.id != github.repository_id }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: setup go cache
        uses: actions/cache@v4
        with:
          path: go_cache
          key: go_linux_test

      - name: Run tests
        run: buildah run -v "$PWD:/karaberus" $(buildah from ghcr.io/odrling/build-images:karaberus-x86_64) /karaberus/ci/test.sh

  test_no_native:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.id != github.repository_id }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest # arm64
          - windows-latest
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: set go env (Windows)
        if: ${{ startsWith(matrix.os, 'windows') }}
        shell: bash
        run: |
          echo GOCACHE="D:\golang\cache" >> $GITHUB_ENV
          echo GOPATH="D:\golang\go" >> $GITHUB_ENV
          echo GOMODCACHE="D:\golang\modcache" >> $GITHUB_ENV

      - uses: actions/setup-go@v5
        with:
          go-version: "stable"

      - name: Install dependencies
        run: |
          pip install meson ninja

      - name: Configure karaberus
        run: meson setup build -Dno_native_deps=true

      - name: Run tests
        run: meson test -C build --verbose
        env:
          KARABERUS_S3_ENDPOINT: localhost:9000
          KARABERUS_S3_KEYID: minio
          KARABERUS_S3_SECRET: miniosecret

  build:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.id != github.repository_id }}
    runs-on: ubuntu-24.04
    env:
      CCACHE_BASEDIR: ${{ github.workspace }}
      CCACHE_DIR: ${{ github.workspace }}/.ccache
      CCACHE_MAXSIZE: 500M

    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        config:
          - arch: x86_64
            platform: linux/amd64
            target: ""
          - arch: aarch64
            platform: linux/arm64
            target: "aarch64-linux-gnu"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: setup go cache
        uses: actions/cache@v4
        with:
          path: go_cache
          key: go_build_${{ matrix.config.arch }}

      - name: Build
        run: buildah run -v "${PWD}:/karaberus" $(buildah from ghcr.io/odrling/build-images:karaberus-${{ matrix.config.arch }}) env TARGET=${{ matrix.config.target }} /karaberus/ci/build.sh

      - name: Docker Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=schedule

      - name: Build image
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          platforms: ${{ matrix.config.platform }}
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ github.sha }}-${{ matrix.config.arch }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            UBUNTU_VERSION=${{ matrix.config.ubuntu_version }}
            TARGET=${{ matrix.config.arch }}-linux-gnu
          containerfiles: ci/Containerfile

      - name: Push image
        id: push-image
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

  push_manifest:
    needs: 
      - build
      - linux_test
      - test_no_native
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'

    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Podman login
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: create and push manifest for supported platforms
        run: |
          image_base_raw=${{ env.IMAGE_NAME }}
          image_base=${image_base_raw@L}
          image_base_sha=${image_base_raw@L}:${{ github.sha }}

          podman manifest create ${image_base}

          archs="${{ env.ARCHS }}"

          for arch in ${archs}; do
            podman pull ${{ env.REGISTRY }}/${image_base_sha}-${arch}
            podman manifest add ${image_base} ${{ env.REGISTRY }}/${image_base_sha}-${arch}
          done

          podman manifest push ${image_base} ${{ env.REGISTRY }}/${image_base_sha}

      - name: push branch manifest
        run: |
          image_base_raw=${{ env.IMAGE_NAME }}
          image_base=${image_base_raw@L}
          podman manifest push ${image_base} ${{ env.REGISTRY }}/${image_base}:${{ github.ref_name }}