image.yaml

name: Container Image

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  ARTIFACT_REGISTRY: europe-north1-docker.pkg.dev
  ARTIFACT_REPO: nais-io/nais/images
  SERVICE_ACCOUNT: gh-bifrost@nais-io.iam.gserviceaccount.com

jobs:
  meta:
    name: Metadata
    runs-on: ubuntu-latest
    outputs:
      "version": ${{ steps.version.outputs.version }}
      "name": ${{ steps.name.outputs.name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: version
        run: echo "version=$(date +'%Y%m%d')-$(git rev-parse --short HEAD)" >> ${GITHUB_OUTPUT}

      - id: name
        run: echo "name=${{ github.event.repository.name }}" >> ${GITHUB_OUTPUT}

  lint:
    name: Lint code
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Go environment
        uses: actions/setup-go@v5
        with:
          go-version: "1.23"
          cache: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: latest
          args: --timeout=5m

  build:
    name: Build and Test code
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Restore cached binaries
        uses: actions/cache/restore@v4
        with:
          path: ${{ github.workspace }}/bin
          key: ${{ runner.os }}-bin-${{ hashFiles('Makefile', 'go.mod') }}
      - name: Set up Go environment
        uses: actions/setup-go@v5
        with:
          go-version: "1.23"
          check-latest: true
      - name: Install make
        run: sudo apt-get update && sudo apt-get install make
      - run: make fmt
      - run: make vet
      - run: make check
      - run: make test
      - run: make build
      - name: Cache installed binaries
        uses: actions/cache@v4
        with:
          path: ${{ github.workspace }}/bin
          key: ${{ runner.os }}-bin-${{ hashFiles('Makefile', 'go.mod') }}

  docker:
    name: Build and push Docker image
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest-16-cores
    needs: meta
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - id: "auth"
        if: github.actor != 'dependabot[bot]'
        name: "Authenticate to Google Cloud"
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT }}
          token_format: "access_token"

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to registry
        if: github.actor != 'dependabot[bot]'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.ARTIFACT_REGISTRY }}/${{ env.ARTIFACT_REPO }}
          username: "oauth2accesstoken"
          password: "${{ steps.auth.outputs.access_token }}"

      - name: Docker meta
        id: metadata
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.ARTIFACT_REGISTRY }}/${{ env.ARTIFACT_REPO }}/${{ needs.meta.outputs.name }}
          # Docker tags based on the following events/attributes
          tags: |
            type=schedule
            type=ref,event=branch
            type=sha
            type=raw,value=${{ needs.meta.outputs.version }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max