ci-containers.yaml

---
name: Build containers and push a release on tag

on:
  workflow_dispatch:
  push:
    branches:
      - master
    tags:
      - 'v*'
  pull_request:
    branches:
      - master

jobs:
  build-container-images:
    outputs:
      digest: ${{ steps.outputs.outputs.digest }}
    permissions:
      contents: read
      packages: write
    name: Build container image
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata from Github
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          # Ensure we strip any 'v' prefix, provide a SHA and a latest tag only for default branch (master)
          tags: |
            type=semver,pattern={{version}},event=tag
            type=sha,prefix=,suffix=,format=short
            type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
            # defaults for others
            type=schedule
            type=ref,event=branch
            type=ref,event=pr

      - name: Build the vivo image
        id: docker_build
        uses: docker/build-push-action@v5
        with:
          build-args: "vivo_base_path=/vivo"
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64
          push: true
          load: false
          target: production

      - name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}
        shell: bash

      - name: Set up outputs
        id: outputs
        run: |
          echo "digest=${{ steps.docker_build.outputs.digest }}" >> $GITHUB_OUTPUT
        shell: bash

  test-container-images:
    name: Test container images
    needs:
      - build-container-images
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.9.0
        with:
          cluster_name: kind
          config: ./kind/config.yaml

      - name: Apply local service using image from this run
        run: |
          sed -i 's|image: calyptia/vivo|image: ghcr.io/chronosphereio/calyptia-vivo@${{ needs.build-container-images.outputs.digest }}|g' ./vivo-deployment.yaml
          cat ./vivo-deployment.yaml
          kubectl apply -f ./vivo-deployment.yaml
        shell: bash

      - name: Check it is running ok
        timeout-minutes: 5
        run: |
          echo "Waiting for deployment to complete..."
          until kubectl rollout status deployment calyptia-vivo --timeout=2s; do
            kubectl describe deployment calyptia-vivo
            sleep 2
          done
          echo
          echo "Deployment completed successfully"
          kubectl get all
        shell: bash

      - name: Inject HTTP traffic
        timeout-minutes: 2
        run: |
          ./kind/curl-port-forward.sh --fail -H 'Content-Type: application/json' -d '{"hello":"world!"}'
        shell: bash

      - name: Debug on failure
        continue-on-error: true
        if: failure()
        run: |
          kubectl cluster-info || true
          kubectl get all || true
          kubectl describe pod  --selector=app.kubernetes.io/name=vivo || true
          kubectl get events || true
          kubectl get pods --all-namespaces -o wide --show-labels || true
          kubectl logs "$(kubectl get pod --selector=app.kubernetes.io/name=vivo --output=jsonpath={.items..metadata.name})" || true
          wget https://raw.githubusercontent.com/johanhaleby/kubetail/master/kubetail
          /bin/bash ./kubetail --follow false --previous false --colored-output false --namespace default || true
          /bin/bash ./kubetail --follow false --previous false --colored-output false --namespace kube-system || true
          kubectl describe pods
          kubectl describe services
        shell: bash

  release-container-images-on-tag:
    if: startsWith(github.ref, 'refs/tags/')
    name: Create release image for vivo
    needs:
      - build-container-images
      - test-container-images
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Get Docker tags
        id: docker_meta
        uses: docker/metadata-action@v5
        with:
          images: |
            calyptia/vivo
            calyptiaci/vivo
          tags: |
            type=semver,pattern={{version}}
            type=raw,value=latest

      - name: Build the vivo image
        id: docker_build
        uses: docker/build-push-action@v5
        with:
          build-args: "vivo_base_path=/vivo"
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          push: true
          target: production

      - name: Images digests
        run: echo ${{ steps.docker_build.outputs.digest }}
        shell: bash

      - uses: sigstore/cosign-installer@main
      - name: Sign Container Image
        continue-on-error: true
        run: |
          cosign sign --recursive --yes calyptia/vivo@${{ steps.docker_build.outputs.digest }}
        shell: bash

  release-on-tag:
    name: Create release
    needs:
      - release-container-images-on-tag
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Release on tag
        uses: softprops/action-gh-release@v1
        with:
          generate_release_notes: true