docker.yml

# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
name: docker

# Trigger the workflow when:
on:
  # A push occurs to one of the matched branches.
  push:
    # XXX: ideally on master branches we would build the image only if there are changes in the
    # 'docker/' directory (as we do in pull_requests). However, this doesn't work when pushing a new
    # 'stable/*' branch - the build on a new branch does not trigger unless there are changes
    # compared to master on the filtered path.
    # If this is ever fixed, or per branch filters are possible, bring back the path filter to only
    # build the image when there are changes within 'docker/' directory.
    branches:
      - master
      - stable/*
  # Or when a pull request event occurs for a pull request against one of the matched branches and at least
  # one modified file matches the configured paths.
  #
  # NOTE: We use this to be able to easily test Docker image changes.
  pull_request:
    branches:
      - master
      - stable/*
    paths:
      - docker/**
  # Or every day at 04:00 UTC (for the default/master branch).
  schedule:
    - cron: "0 4 * * *"

# Cancel in progress jobs on new pushes.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:

  build-images:
    # NOTE: This name appears in GitHub's Checks API.
    name: build-images
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # Check out pull request's HEAD commit instead of the merge commit.
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Determine tag name
        id: determine_tag
        shell: bash
        run: |
          if [[ -z $GITHUB_BASE_REF ]]; then
            # On master/stable branches.
            branch=${GITHUB_REF#refs/heads/}
          else
            # On pull request branches.
            branch=pr-$(git describe --always --match '' --abbrev=7)
          fi
          branch=${branch//\//-}
          echo "tag=${branch}" >> $GITHUB_OUTPUT
          echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to DockerHub
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: "Rebuild ghcr.io/oasisprotocol/oasis-core-dev:${{ steps.determine_tag.outputs.tag }}"
        uses: docker/build-push-action@v4
        with:
          context: docker/oasis-core-dev
          file: docker/oasis-core-dev/Dockerfile
          tags: ghcr.io/oasisprotocol/oasis-core-dev:${{ steps.determine_tag.outputs.tag }}
          pull: true
          push: true
          provenance: false
          labels: |
            org.opencontainers.image.source=${{ github.event.repository.html_url }}
            org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: "Rebuild ghcr.io/oasisprotocol/oasis-core-ci:${{ steps.determine_tag.outputs.tag }}"
        uses: docker/build-push-action@v4
        with:
          context: docker/oasis-core-ci
          file: docker/oasis-core-ci/Dockerfile
          tags: ghcr.io/oasisprotocol/oasis-core-ci:${{ steps.determine_tag.outputs.tag }}
          pull: true
          push: true
          provenance: false
          build-args: OASIS_CORE_DEV_BASE_TAG=${{ steps.determine_tag.outputs.tag }}
          labels: |
            org.opencontainers.image.source=${{ github.event.repository.html_url }}
            org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: "Rebuild ghcr.io/oasisprotocol/aesmd:${{ steps.determine_tag.outputs.tag }}"
        uses: docker/build-push-action@v4
        with:
          context: docker/aesmd
          file: docker/aesmd/Dockerfile
          tags: ghcr.io/oasisprotocol/aesmd:${{ steps.determine_tag.outputs.tag }}
          pull: true
          push: true
          provenance: false
          labels: |
            org.opencontainers.image.source=${{ github.event.repository.html_url }}
            org.opencontainers.image.created=${{ steps.determine_tag.outputs.created }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: Prune old ghcr.io/oasisprotocol/oasis-core-dev images
        uses: vlaurin/action-ghcr-prune@v0.5.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          organization: oasisprotocol
          container: oasis-core-dev
          keep-younger-than: 7 # days
          keep-last: 2
          prune-untagged: true
          prune-tags-regexes: ^pr-

      - name: Prune old ghcr.io/oasisprotocol/oasis-core-ci images
        uses: vlaurin/action-ghcr-prune@v0.5.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          organization: oasisprotocol
          container: oasis-core-ci
          keep-younger-than: 7 # days
          keep-last: 2
          prune-untagged: true
          prune-tags-regexes: ^pr-

      - name: Prune old ghcr.io/oasisprotocol/aesmd images
        uses: vlaurin/action-ghcr-prune@v0.5.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          organization: oasisprotocol
          container: aesmd
          keep-younger-than: 7 # days
          keep-last: 2
          prune-untagged: true
          prune-tags-regexes: ^pr-