ci-oci.yaml

# https://github.com/marketplace/actions/install-nix

# Builds oci container in a rather convoluted way.

name: "ci-oci"
on:
  pull_request:
  push:
    tags:
      - "v*"

permissions:
  packages: write

env:
  REGISTRY_USER: ${{ github.actor }}
  REGISTRY_PASSWORD: ${{ github.token }}
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

concurrency:
  group: "ci-oci-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  tests:
    strategy:
      matrix:
        image: [wst, wst-poc-mock-server]
    runs-on: ubuntu-latest
    steps:

    - name: Determine image tag for git tag
      if: ${{ github.event_name == 'push' }}
      run: |
        IMAGE_TAG=$(git rev-parse --abbrev-ref "${{ github.event.push.ref }}")
        echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV

    - name: Determine image tag for PR
      if: ${{ github.event_name == 'pull_request' }}
      run: |
        IMAGE_TAG=pr-${{ github.event.pull_request.number }}
        echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV

    - name: Log in to ghcr.io
      uses: redhat-actions/podman-login@v1
      with:
        username: ${{ env.REGISTRY_USER }}
        password: ${{ env.REGISTRY_PASSWORD }}
        registry: ${{ env.IMAGE_REGISTRY }}

    - uses: actions/checkout@v4

    - name: Install nix
      uses: cachix/install-nix-action@v27

    # https://github.com/marketplace/actions/cache-nix-store
    - name: Restore and cache Nix store
      uses: nix-community/cache-nix-action@v5
      with:
        # restore and save a cache using this key
        # TODO: Also hash the cabal.config and *cabal files, since we depend on them
        primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
        # if there's no cache hit, restore a cache by this prefix
        restore-prefixes-first-match: nix-${{ runner.os }}-
        # collect garbage until Nix store size (in bytes) is at most this number
        # before trying to save a new cache
        gc-max-store-size-linux: 1073741824
        # do purge caches
        purge: true
        # purge all versions of the cache
        purge-prefixes: cache-${{ runner.os }}-
        # created more than this number of seconds ago relative to the start of the `Post Restore` phase
        purge-created: 0
        # except the version with the `primary-key`, if it exists
        purge-primary-key: never

    # TODO: matrix build for two images (mock server and wst)
    - name: Build image with nix
      run: nix build --accept-flake-config .#containers.x86_64-linux.${{ matrix.image }}.copyTo
    - name: Publish tagged image with podman
      run: |
        IMAGE_NAME=ghcr.io/${{github.repository_owner}}/${{ matrix.image }}:$IMAGE_TAG
        ./result/bin/copy-to oci-archive:oci.tar
        IMAGE_HASH=$(podman load --quiet -i oci.tar | sed 's/.*sha256://')
        podman tag $IMAGE_HASH $IMAGE_NAME
        podman push $IMAGE_NAME