build.yaml

name: ci/cd
on:
  pull_request:
  repository_dispatch:
    types: [build]
  workflow_dispatch:

jobs:
  build:
    timeout-minutes: 360
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    runs-on: ${{ matrix.platform == 'linux/amd64' && 'ubuntu-24.04' || matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' }}
    name: build ${{ matrix.platform }}
    outputs:
      tag: ${{ steps.envvars.outputs.tag }}
    steps:
      - name: "node-cleanup"
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
          sudo docker image prune --all --force
          sudo docker builder prune -a
      
      - name: checkout
        uses: actions/checkout@v6.0.2

      - name: Prepare env
        id: envvars
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
          if [ ${{ github.event.client_payload.tag }} != 'null' ]; then
            echo "tag=${{ github.event.client_payload.tag }}" >> $GITHUB_OUTPUT
          else
            echo "tag=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
          fi

      - name: Metadata
        id: meta
        uses: docker/metadata-action@v6.0.0
        with:
          images: ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v4.0.0

      - name: Build and push by digest
        if: github.event_name == 'pull_request'
        uses: docker/build-push-action@v7.0.0
        with:
          file: ./docker/Dockerfile
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}
          outputs: type=docker,push-by-digest=true,name-canonical=true,push=true

      - name: Run tests
        if: github.event_name == 'pull_request'
        shell: bash
        run: |
          docker run -t ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}:latest bash -c " \
            pip install pytest nbmake; \
            find . -name '*.ipynb' | pytest --nbmake --nbmake-timeout=3600 --ignore=answers; "

      - name: Authenticate with GHCR
        if: github.event_name != 'pull_request'
        id: auth
        uses: docker/login-action@v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.BUILD_TOKEN }}

      - name: Build and push by digest
        if: github.event_name != 'pull_request'
        id: build
        uses: docker/build-push-action@v7.0.0
        with:
          file: ./docker/Dockerfile
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          tags: ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true

      - name: Run tests
        if: github.event_name != 'pull_request'
        shell: bash
        run: |
          docker run -t ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}@${{ steps.build.outputs.digest }} bash -c " \
            pip install pytest nbmake; \
            find . -name '*.ipynb' | pytest --nbmake --nbmake-timeout=3600 --ignore=answers; "

      - name: Export digest
        if: github.event_name != 'pull_request'
        run: |
          mkdir -p ${{ runner.temp }}/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v7.0.0
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  tags:
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    name: merge and tag
    needs:
      - build
    steps:
      - name: Download digests
        uses: actions/download-artifact@v8.0.0
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Authenticate with GHCR
        id: auth
        uses: docker/login-action@v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.BUILD_TOKEN }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v4.0.0

      - name: Metadata
        id: meta
        uses: docker/metadata-action@v6.0.0
        with:
          images: ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}
          tags: |
            latest
            ${{ needs.build.outputs.tag }}

      - name: Create manifest list and push
        id: annotate
        continue-on-error: true
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            --annotation='index:org.opencontainers.image.description=${{ github.event.repository.description }}' \
            --annotation='index:org.opencontainers.image.licenses=MIT' \
            --annotation='index:org.opencontainers.image.created=${{ steps.timestamp.outputs.timestamp }}' \
            --annotation='index:org.opencontainers.image.url=${{ github.event.repository.url }}' \
            --annotation='index:org.opencontainers.image.source=${{ github.event.repository.url }}' \
            $(printf 'ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}@sha256:%s ' *)

      - name: Create manifest list and push without annotations
        if: steps.annotate.outcome == 'failure'
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create  $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf 'ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ghcr.io/${{ vars.ORG_REPO }}/${{ github.event.repository.name }}:latest

      - name: Post version update to dash
        uses: peter-evans/repository-dispatch@v4.0.1
        with:
          token: ${{ secrets.BUILD_TOKEN }}
          repository: ccpbiosim/ccpbiosim.github.io
          event-type: build    
          client-payload: '{"repo": "${{ github.event.repository.name }}", "tag": "${{ needs.build.outputs.tag }}"}'