ci.yaml

name: CI

on:
  pull_request:
    branches: [master]
  push:
    branches: [master]
  release:
    types: [created]

permissions: read-all

env:
  IMAGE_NAME: ghcr.io/${{ github.repository }}

jobs:
  build:
    name: Build
    runs-on: ubuntu-22.04
    permissions:
      packages: write
    outputs:
      image-tags: ${{ steps.container_meta.outputs.tags }}
      image-digest: ${{ steps.build.outputs.digest }}
      image-name: ${{ env.IMAGE_NAME }}
    steps:
      - name: Checkout code
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3

      - name: Container meta
        id: container_meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5
        with:
          images: |
            ${{ env.IMAGE_NAME }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        if: ${{ github.event_name != 'pull_request' }}
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get platforms to build
        id: platforms
        run: |
          if [ "$IS_PULL_REQUEST" == "true" ]; then
            echo "{platforms}={linux/amd64}" >> "$GITHUB_OUTPUT"
          else
            echo "{platforms}={linux/amd64}" >> "$GITHUB_OUTPUT"
          fi
        env:
          IS_PULL_REQUEST: ${{ github.event_name == 'pull_request' }}

      - name: Build and push
        id: build
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5
        with:
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.container_meta.outputs.tags }}
          labels: ${{ steps.container_meta.outputs.labels }}
          load: ${{ github.event_name == 'pull_request' }}
          platforms: ${{ steps.platforms.outputs.platforms }}

      - name: List images
        run: |
          docker image ls

      - name: Run E2E tests
        env:
          KAFKA_FHIR_TO_SERVER_IMAGE: "${{ fromJson(steps.container_meta.outputs.json).tags[0] }}"
        run: |
          docker compose -f compose.yml -f tests/e2e/compose.yml --project-directory=tests/e2e build
          docker compose -f compose.yml -f tests/e2e/compose.yml --project-directory=tests/e2e run test

      - name: Print E2E logs and shutdown
        if: always()
        env:
          KAFKA_FHIR_TO_SERVER_IMAGE: "${{ fromJson(steps.container_meta.outputs.json).tags[0] }}"
        run: |
          docker compose -f compose.yml -f tests/e2e/compose.yml logs
          docker compose -f compose.yml -f tests/e2e/compose.yml down --volumes --remove-orphans

  sign-images:
    name: sign images
    runs-on: ubuntu-22.04
    if: ${{ github.event_name != 'pull_request' }}
    needs:
      - build
    permissions:
      id-token: write
      packages: write
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2

      - name: Sign image
        env:
          IMAGES: ${{ needs.build.outputs.image-tags }}
          DIGEST: ${{ needs.build.outputs.image-digest }}
        run: |
          while read -r image; do
            echo "Signing '$image' using keyless approach"
            cosign sign --yes "$image@$DIGEST"
          done <<< "$IMAGES"

  container-provenance:
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    needs:
      - build
    permissions:
      actions: read # for detecting the Github Actions environment.
      id-token: write
      packages: write # for uploading attestations.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
    with:
      image: ${{ needs.build.outputs.image-name }}
      digest: ${{ needs.build.outputs.image-digest }}
      registry-username: ${{ github.actor }}
      # TODO(https://github.com/slsa-framework/slsa-github-generator/issues/492): Remove after GA release.
      compile-generator: true
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  release:
    needs: build
    name: release
    runs-on: ubuntu-22.04
    if: ${{ github.event_name != 'pull_request' }}
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          fetch-depth: 0

      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@61680d0e9b02ff86f5648ade99e01be17f0260a4 # v4.0.0
        with:
          extra_plugins: |
            conventional-changelog-conventionalcommits@5.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.MIRACUM_BOT_SEMANTIC_RELEASE_TOKEN }}