docker-image.yml

name: Build & push Docker image

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Docker image version"
        type: string
        required: true

env:
  SERVER_IMAGE_NAME: "grimoirelab/sortinghat"
  WORKER_IMAGE_NAME: "grimoirelab/sortinghat-worker"

jobs:
  build-package:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [20.x]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Setup Node ${{ matrix.node-version }}
        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # 4.0.1
        with:
          node-version: ${{ matrix.node-version }}
      - name: Create JS files
        working-directory: ./ui
        run: |
          yarn install
          yarn build
      - name: Build package using Poetry and store result
        uses: chaoss/grimoirelab-github-actions/build@master
        with:
          artifact-name: sortinghat-dist
          artifact-path: dist
          skip-checkout: yes

  build-image:
    runs-on: ubuntu-latest
    needs: [build-package]
    environment: docker-release
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Download distribution artifact
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: sortinghat-dist
          path: dist

      - name: Install Cosign
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
        with:
          platforms: linux/arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0

      - name: Login to DockerHub
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Server Docker metadata
        id: meta-server
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            ${{ env.SERVER_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},value=${{ inputs.version }}

      - name: Server Build and push
        id: build-and-push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          platforms: linux/amd64,linux/arm64
          context: .
          file: "docker/server.dockerfile"
          push: true
          tags: ${{ steps.meta-server.outputs.tags }}

      - name: Server Sign image with a key
        run: |
          echo "${TAGS}" | xargs -I {} cosign sign -y -r --key env://COSIGN_PRIVATE_KEY "{}@${DIGEST}"
        env:
          TAGS: ${{ steps.meta-server.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}

      - name: Worker Docker metadata
        id: meta-worker
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            ${{ env.WORKER_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},value=${{ inputs.version }}

      - name: Worker Build and push
        id: build-and-push-worker
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
        with:
          platforms: linux/amd64,linux/arm64
          context: .
          file: "docker/worker.dockerfile"
          push: true
          tags: ${{ steps.meta-worker.outputs.tags }}

      - name: Worker Sign image with a key
        run: |
          echo "${TAGS}" | xargs -I {} cosign sign -y -r --key env://COSIGN_PRIVATE_KEY "{}@${DIGEST}"
        env:
          TAGS: ${{ steps.meta-worker.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
          DIGEST: ${{ steps.build-and-push-worker.outputs.digest }}