publish-build.yml

name: publish

on:

  push:
    branches:
      # pushes to main will trigger an EDGE image
      - main

  release:
    # The prereleased type will not trigger for pre-releases published from draft releases, but the published type will trigger.
    # If you want a workflow to run when stable and pre-releases publish, subscribe to published instead of released and prereleased.
    types:
      - published

  schedule:
    # * is a special character in YAML so you have to quote this string
    # at 03:00 on each Tuesday attempt to build a new image
    - cron:  '0 3 * * 2'

concurrency:
  group: publish-${{ github.head_ref }}
  cancel-in-progress: false

jobs:
  docker:
    runs-on: ubuntu-latest

    permissions:
      # when permissions are defined only those that are explicitly set will be enabled
      # this workflow job currently only requires reading contents and writing packages.
      # https://docs.github.com/en/actions/reference/authentication-in-a-workflow#modifying-the-permissions-for-the-github_token
      contents: read
      packages: write

    strategy:
      fail-fast: true
      max-parallel: 1
      matrix:
        target:
          - base
          - cypress

    steps:
      - name: Validate secret defined
        id: from_secrets
        run: |
          github_container_push="true";
          dockerhub_token_exists="false";
          dockerhub_username_exists="false";
          dockerhub_namespace_exists="false";

          dockerhub_token="${{ secrets.DOCKERHUB_TOKEN }}";
          if [[ -n "${dockerhub_token}" ]]; then
            dockerhub_token_exists="true";
          fi

          dockerhub_username="${{ secrets.DOCKERHUB_USERNAME }}";
          if [[ -n "${dockerhub_username}" ]]; then
            dockerhub_username_exists="true";
          fi

          dockerhub_namespace="${{ secrets.DOCKERHUB_NAMESPACE }}";
          if [[ -n "${dockerhub_namespace}" ]]; then
            dockerhub_namespace_exists="true";
          fi

          github_container_push_disabled="${{ secrets.GITHUB_CONTAINER_PUSH_DISABLED }}";
          if [[ "true" = "${github_container_push_disabled}" ]]; then
            github_container_push="false";
          fi

          echo "::set-output name=dockerhub_token_exists::${dockerhub_token_exists}";
          echo "::set-output name=dockerhub_username_exists::${dockerhub_username_exists}";
          echo "::set-output name=dockerhub_namespace_exists::${dockerhub_namespace_exists}";
          echo "::set-output name=github_container_push::${github_container_push}";
      - name: Generate container image names
        id: generate_image_names
        run: |
          repository_name="$(basename "${GITHUB_REPOSITORY}")";
          images=();
          github_container_push="${{ steps.from_secrets.outputs.github_container_push }}";
          if [[ "${github_container_push}" = "true" ]];
          then
            # set GITHUB_CONTAINER_PUSH_DISABLED to a value of true to disable pushing to github container registry
            images+=("ghcr.io/${GITHUB_REPOSITORY}");
          fi

          dockerhub_token="${{ secrets.DOCKERHUB_TOKEN }}";
          dockerhub_username="${{ secrets.DOCKERHUB_USERNAME }}";
          dockerhub_namespace="${{ secrets.DOCKERHUB_NAMESPACE }}";
          if [[ -n "${dockerhub_token}" ]] && [[ -n "${dockerhub_username}" ]] && [[ -n "${dockerhub_namespace}" ]];
          then
            # dockerhub repository should be the same as the github repository name, within the dockerhub namespace (organization or personal)
            images+=("${dockerhub_namespace}/${repository_name}");
          fi
          # join the array for Docker meta job to produce image tags
          # https://github.com/crazy-max/ghaction-docker-meta#inputs
          echo "::set-output name=images::$(IFS=,; echo "${images[*]}")";
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: ${{ steps.generate_image_names.outputs.images }}
          labels: |
            maintainer=arledesma
            org.opencontainers.image.title=Amplify Build Image
            org.opencontainers.image.description=Build Image for AWS Amplify
            org.opencontainers.image.base.name=amazonlinux:2
          flavor: |
            latest=auto
            prefix=${{ matrix.target }}-
            suffix=
          tags: |
            type=schedule,pattern={{date 'YYYYMMDD'}}
            type=edge,branch=main
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1
        with:
          version: latest
          install: true
          use: true

      - name: Login to DockerHub
        uses: docker/login-action@v1
        # conditions do not have direct access to github secrets so we check the output of the step from_secrets
        if: ${{ steps.from_secrets.outputs.dockerhub_namespace_exists == 'true' && steps.from_secrets.outputs.dockerhub_token_exists == 'true' && steps.from_secrets.outputs.dockerhub_username_exists == 'true' }}
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        if: ${{ steps.from_secrets.outputs.github_container_push == 'true' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push base
        uses: docker/build-push-action@v2
        with:
          target: ${{ matrix.target }}
          builder: ${{ steps.buildx.outputs.name }}
          # Setting context causes 'buildx failed with: error: failed to solve: failed to read dockerfile: open /tmp/buildkit-mountXXXXXXXXX/Dockerfile: no such file or directory'
          # context: .
          platforms: linux/amd64
          push: ${{ contains(fromJson('["push", "schedule", "release"]'), github.event_name) }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max