build-push.yml

name: build-push

on:
  push:
    branches-ignore:
      - gh-readonly-queue/**
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  DRY_RUN: ${{ github.ref_name != 'main' }}
  OWNER: ${{ github.repository_owner }}
  FILE: base
  BUILDKIT_PROGRESS: plain
  BUILDX_NO_DEFAULT_LOAD: 1
  NODE_VERSION: 18.16.0 # renovate: datasource=node depName=node
  CONTAINERBASE_VERSION: ${{ github.sha }}
  APT_HTTP_PROXY: http://172.17.0.1:8000

jobs:
  build:
    uses: ./.github/workflows/build.yml
    permissions:
      contents: read
      checks: write
    secrets:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

  release:
    needs: [build]
    runs-on: ubuntu-latest
    timeout-minutes: 15

    permissions:
      contents: write
      packages: write
      id-token: write

    steps:
      - name: docker-config
        uses: containerbase/internal-tools@cf1f6a8bd578e90476b0b7ad44a40fa47add7ff7 # v1.17.2
        with:
          command: docker-config

      # full checkout for semantic-release
      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
        with:
          fetch-depth: 0

      - uses: sigstore/cosign-installer@9e9de2292db7abb3f51b7f4808d98f0d347a8919 # v3.0.2

      - name: init
        run: |
          echo "OWNER=${OWNER,,}" >> ${GITHUB_ENV}

      - name: Set up Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: yarn

      - name: enable corepack
        run: sudo corepack enable

      - name: Init platform
        run: |
          git config --global core.autocrlf false
          git config --global core.symlinks true
          git config --global user.email 'renovate@whitesourcesoftware.com'
          git config --global user.name  'Renovate Bot'
          echo "CACHE_WEEK=$(date +%U)" >> $GITHUB_ENV

      - name: Docker registry login
        if: github.ref_name == 'main'
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Installing dependencies
        run: yarn install

      - name: prepare apt proxy
        run: sudo yarn prepare:proxy

      - name: semantic-release
        if: github.event_name == 'push'
        run: yarn semantic-release --dry-run ${{env.DRY_RUN}} --ci ${{env.DRY_RUN != 'true'}}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}