ci: publish container and artifacts on merge to main

.github/workflows/ci.yaml

@@ -1,54 +1,55 @@
-name: CI
+name: CI/CD
 on:
+  workflow_call:
   push:
     branches:
       - main
   pull_request:
   workflow_dispatch:
 
-jobs:
-  fmt:
-    name: Check Formatting
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@v2
-
-      - name: Check formatting
-        run: cargo fmt --check --all
-
-  check:
-    name: Lint and Build
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@v2
+# https://stackoverflow.com/a/72408109
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
-      - name: Clippy lints
-        run: cargo clippy --all --all-features --all-targets --no-deps -- -D warnings
-
-      - name: Cargo Doc
-        run: RUSTDOCFLAGS="-D warnings" cargo doc --all --all-features --no-deps --document-private-items
+jobs:
+  check-inputs:
+    runs-on: ubuntu-24.04
+    outputs:
+      cargo-profile: ${{ steps.set-cargo-profile.outputs.CI_CARGO_PROFILE }}
+      is-default-branch: ${{ steps.set-is-default-branch.outputs.CI_IS_DEFAULT_BRANCH }}
 
-  test:
-    name: Run Tests on all platforms
-    strategy:
-      matrix:
-        runs-on: ["ubuntu-24.04", "windows-2022", "macos-14"]
-    runs-on: ${{ matrix.runs-on }}
     steps:
-      - uses: actions/checkout@v4
-      - name: Cache cargo dependencies
-        uses: Swatinem/rust-cache@v2
+      - name: Set is-default-branch
+        id: set-is-default-branch
+        run: |
+          CI_IS_DEFAULT_BRANCH="${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}"
+          echo "CI_IS_DEFAULT_BRANCH=${CI_IS_DEFAULT_BRANCH}" >> $GITHUB_OUTPUT
+          echo "CI_IS_DEFAULT_BRANCH=${CI_IS_DEFAULT_BRANCH}" >> $GITHUB_ENV
+          echo "CI_IS_DEFAULT_BRANCH=${CI_IS_DEFAULT_BRANCH}"
+      - name: Set cargo-profile
+        id: set-cargo-profile
+        run: |
+          if [[ ${CI_IS_DEFAULT_BRANCH} == 'true' ]]; then
+            CI_CARGO_PROFILE="artifact"
+          else
+            CI_CARGO_PROFILE="artifact-dev"
+          fi
+          echo "CI_CARGO_PROFILE=${CI_CARGO_PROFILE}" >> $GITHUB_OUTPUT
+          echo "CI_CARGO_PROFILE=${CI_CARGO_PROFILE}"
+
+  rust:
+    name: Rust
+    needs: check-inputs
+    uses: ./.github/workflows/rust.yaml
+    with:
+      cargo-profile: ${{ needs.check-inputs.outputs.cargo-profile }}
+
+  container:
+    name: Container
+    needs: [rust, check-inputs]
+    uses: ./.github/workflows/container.yaml
+    with:
+      push: ${{ needs.check-inputs.outputs.is-default-branch == 'true' }}
+      additional-tags: ${{ (needs.check-inputs.outputs.is-default-branch == 'true') && 'latest' || '' }}
 
-      - name: Test
-        run: cargo test --all --all-features --all-targets
-
-  deny:
-    name: Run cargo deny
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: actions/checkout@v4
-    - uses: EmbarkStudios/cargo-deny-action@v1

.github/workflows/container.yaml

@@ -0,0 +1,49 @@
+name: Build Containers
+on:
+  workflow_call:
+    inputs:
+      additional-tags:
+        type: string
+      push:
+        required: true
+        type: boolean
+
+jobs:
+  build:
+    name: Build Container
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/[email protected]
+      - name: Download Rust Artifacts
+        uses: actions/[email protected]
+        with:
+          name: rust
+          path: artifacts
+
+      - name: Build Image
+        id: build-image
+        uses: redhat-actions/[email protected]
+        with:
+          image: identity-server
+          tags: commit-${{ github.sha }} ${{ inputs.additional-tags }}
+          oci: true
+          containerfiles: |
+            ./identity-server/Dockerfile
+
+      - name: Get registry url
+        run: |
+          # Container registries don't support upper case letters
+          CI_REGISTRY_URL="ghcr.io/${GITHUB_REPOSITORY_OWNER@L}"
+          echo "CI_REGISTRY_URL=${CI_REGISTRY_URL}" >> "${GITHUB_ENV}"
+          echo "CI_REGISTRY_URL=${CI_REGISTRY_URL}"
+
+      - name: Push To Github Packages
+        if: ${{ inputs.push }}
+        uses: redhat-actions/[email protected]
+        with:
+          image: ${{ steps.build-image.outputs.image }}
+          tags: ${{ steps.build-image.outputs.tags }}
+          registry: ${{ env.CI_REGISTRY_URL }}
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+          extra-args: --disable-content-trust