docker-release.yml

name: docker-release

on:
  release:
    types: [published]

jobs:
  build-and-push:
    strategy:
      matrix:
        image: [
          { name: "divviup_api", rust-features: ["default"] },
          { name: "divviup_api_integration_test", rust-features: ["integration-testing", "admin"] },
        ]
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - id: resolve_variables
        run: |
          echo "GIT_REVISION=$(git describe --always --dirty=-modified)" >> $GITHUB_OUTPUT
          IMAGE=${{ matrix.image.name }}:${GITHUB_REF/refs\/tags\//}
          echo "PUBLIC_TAG=us-west2-docker.pkg.dev/divviup-artifacts-public/divviup-api/${IMAGE}" >> $GITHUB_OUTPUT
          echo "PRIVATE_TAG=us-west2-docker.pkg.dev/janus-artifacts/divviup-api/${IMAGE}" >> $GITHUB_OUTPUT
          # Join features with , for RUST_FEATURES, but - for cache keys, where commas are illegal
          echo "CACHE_KEY=${{ join(matrix.image.rust-features, '-') }}" >> $GITHUB_OUTPUT
          echo "RUST_FEATURES=${{ join(matrix.image.rust-features, ',') }}" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker-container
          use: true
      - name: Build
        uses: docker/build-push-action@v6
        with:
          context: .
          # Do not push in this step so we can push to the private and public repositories
          # separately in later steps, but do load so that the images will be visible to `docker
          # push`
          push: false
          load: true
          tags: "${{ steps.resolve_variables.outputs.PUBLIC_TAG}},${{ steps.resolve_variables.outputs.PRIVATE_TAG }}"
          build-args: |
            GIT_REVISION=${{ steps.resolve_variables.outputs.GIT_REVISION }}
            RUST_FEATURES=${{ steps.resolve_variables.outputs.RUST_FEATURES }}
          cache-from: |
            type=gha,scope=main-${{ steps.resolve_variables.outputs.CACHE_KEY }}
      - id: gcp-auth-private
        name: Authenticate to GCP (private repository)
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.GCP_ARTIFACTS_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.GCP_ARTIFACTS_PUBLISHER_SERVICE_ACCOUNT }}
          token_format: access_token
          access_token_lifetime: "3600s"
          access_token_scopes: https://www.googleapis.com/auth/cloud-platform
      - name: Docker login (private repository)
        uses: docker/login-action@v3
        with:
          registry: us-west2-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.gcp-auth-private.outputs.access_token }}
      - name: Push (private repository)
        run: docker push ${{ steps.resolve_variables.outputs.PRIVATE_TAG }}
      - id: gcp-auth-public
        name: Authenticate to GCP (public repository)
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.GCP_GAR_PUBLIC_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.GCP_GAR_PUBLIC_PUBLISHER_SERVICE_ACCOUNT }}
          token_format: access_token
          access_token_lifetime: "3600s"
          access_token_scopes: https://www.googleapis.com/auth/cloud-platform
      - name: Docker login (public repository)
        uses: docker/login-action@v3
        with:
          registry: us-west2-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.gcp-auth-public.outputs.access_token }}
      - name: Push (public repository)
        run: docker push ${{ steps.resolve_variables.outputs.PUBLIC_TAG }}