keip/.github/workflows/webapp.yml at main · codice/keip · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: webapp
on:
  workflow_dispatch:
  pull_request:
    paths:
      - webapp/**
      - .github/workflows/webapp.yml
      - .github/workflows/scripts
      - '!**.md'
  push:
    branches:
      - main
    paths:
      - webapp/**
      - '!**.md'

env:
  PYTHON_VERSION: 3.11
  WORKING_DIR: ./webapp

permissions:
  contents: read

jobs:
  verify-versions:
    if: github.ref != 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - run: sh .github/workflows/scripts/verify_webapp_releasable.sh
        name: Verify webapp is in a state to be released on merge
  test:
    name: unit test
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - run: make test

  lint:
    name: python linter
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - run: make lint

  build:
    name: build image
    needs: test
    if: github.ref != 'refs/heads/main'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
        with:
          context: ${{ env.WORKING_DIR }}
          platforms: linux/amd64,linux/arm64
          push: false

  release:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    permissions:
      contents: write # create git tags
      packages: write # push docker images
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - run: |
          REGISTRY=$(make get-registry)
          IMAGE_NAME=$(make get-image-name)
          GIT_TAG=$(make get-tag)
          echo "REGISTRY=$REGISTRY" >> "$GITHUB_OUTPUT"
          echo "TAG_NAME=$GIT_TAG" >> "$GITHUB_OUTPUT"
          echo "FULL_IMAGE_NAME=$IMAGE_NAME" >> "$GITHUB_OUTPUT"
          cat $GITHUB_OUTPUT
        id: naming-selector
        name: generate names for artifacts

      - run: |
          git fetch --tags
          if git rev-parse -q --verify "refs/tags/${{ steps.naming-selector.outputs.TAG_NAME }}"; then
            # confirm image exists
            docker manifest inspect ${{ steps.naming-selector.outputs.FULL_IMAGE_NAME }}
          else
            echo "needs_release=true" >> $GITHUB_ENV
          fi
        name: check if release is needed

      - uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
        if: env.needs_release == 'true'
        with:
          registry: ${{ steps.naming-selector.outputs.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        if: env.needs_release == 'true'
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
        if: env.needs_release == 'true'
        with:
          context: ${{ env.WORKING_DIR }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.naming-selector.outputs.FULL_IMAGE_NAME }}

      - uses: mathieudutour/github-tag-action@fcfbdceb3093f6d85a3b194740f8c6cec632f4e2 # v6.1
        if: env.needs_release == 'true'
        id: tag_version
        with:
          custom_tag: ${{ steps.naming-selector.outputs.TAG_NAME }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # avoid v prefix before tag
          tag_prefix: ""