publish.yaml

name: container publish
run-name: Publish container from ${{ inputs.rock }} to ghcr.io/canonical/identity-platform-admin-ui

on:
  workflow_call:
    secrets:
      token:
        required: true
    inputs:
      rock:
        type: string
        required: true
        description: "rock path to download"
    outputs:
      image:
        description: "container image"
        value: ${{ jobs.publish.outputs.image }}

jobs:
  publish:
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.set.outputs.image }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

    - name: Download Artifact
      uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
      with:
        name: ${{ inputs.rock }}

    # Use the rockcraft snap to get skopeo because the snap and the apt package on the ubuntu
    # archives are very old. Only rockcraft=latest/edge has a newer skopeo version
    # TODO(nsklikas): Either use rockcraft=latest/stable or install skopeo from apt when one
    # of them is updated
    - name: Install Rockcraft to get skopeo
      run: |
        sudo snap install --classic --channel latest/edge rockcraft

    - name: Install Container Structure Tests tools
      run: |
        mkdir -p bin/
        curl -Lo bin/container-structure-test https://storage.googleapis.com/container-structure-test/latest/container-structure-test-linux-amd64
        chmod +x bin/container-structure-test
        echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH
    - name: Run container structural tests
      run: |
        # docker-daemon avoids the push to the remote registry
        sudo rockcraft.skopeo --insecure-policy copy oci-archive:$(realpath ./"${{ inputs.rock }}") docker-daemon:ghcr.io/canonical/identity-platform-admin-ui:${{ github.sha }} --dest-creds ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}
        container-structure-test test -c structure-tests.yaml -i ghcr.io/canonical/identity-platform-admin-ui:${{ github.sha }}
    - name: Upload ROCK to ghcr.io with latest
      id: latest
      if: github.ref_type == 'branch'
      run: |
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./"${{ inputs.rock }}") docker://ghcr.io/canonical/identity-platform-admin-ui:"${{ github.sha }}" --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}"
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./"${{ inputs.rock }}") docker://ghcr.io/canonical/identity-platform-admin-ui:latest --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}"
        echo "image=ghcr.io/canonical/identity-platform-admin-ui:${{ github.sha }}" >> "$GITHUB_ENV"
    - name: Upload ROCK to ghcr.io with stable
      id: stable
      if: github.ref_type == 'tag'
      run: |
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./"${{ inputs.rock }}") docker://ghcr.io/canonical/identity-platform-admin-ui:"${{ github.ref_name }}" --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}"
        sudo skopeo --insecure-policy copy oci-archive:$(realpath ./"${{ inputs.rock }}") docker://ghcr.io/canonical/identity-platform-admin-ui:stable --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}"
        echo "image=ghcr.io/canonical/identity-platform-admin-ui:${{ github.ref_name }}" >> "$GITHUB_ENV"
    - name: Set output of image
      id: set
      run: echo "image=$image" >> "$GITHUB_OUTPUT"

  oci-factory:
    runs-on: ubuntu-latest
    # only release to oci-factory in case of release
    if: github.ref_type == 'tag'
    steps:
      - name: Checkout repository
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
      - name: Golang setup
        uses: actions/setup-go@v5
        with:
          go-version: '>=1.22.0'
      # install oci-factory via golang and set path in environment
      - name: Install oci-factory
        run: |
          sudo apt update && sudo apt install -y git
          go install github.com/canonical/oci-factory/tools/cli-client/cmd/oci-factory@latest
          go install github.com/mikefarah/yq/v4@v4.44.3
          echo "OCI_FACTORY=$(go env GOPATH)/bin/oci-factory" >> $GITHUB_ENV
          echo "YQ=$(go env GOPATH)/bin/yq" >> $GITHUB_ENV
      - name: Set EOLs and version
        run: |
          echo EOL_STABLE=$(date -d "$(date +'%Y-%m-%d') +6 month" "+%Y-%m-%d") >> $GITHUB_ENV
          echo EOL_CANDIDATE=$(date -d "$(date +'%Y-%m-%d') +14 day" "+%Y-%m-%d") >> $GITHUB_ENV
          echo IMAGE_VERSION_STABLE=$($YQ '.version | split(".").0' rockcraft.yaml) >> $GITHUB_ENV
          echo IMAGE_VERSION_CANDIDATE=$($YQ '.version | split(".").[0:2] | join(".")' rockcraft.yaml) >> $GITHUB_ENV
      - name: Release
        run: |
          $OCI_FACTORY upload -y --release track=$IMAGE_VERSION_STABLE-22.04,risks=stable,eol=$EOL_STABLE
          $OCI_FACTORY upload -y --release track=$IMAGE_VERSION_CANDIDATE-22.04,risks=candidate,edge,eol=$EOL_CANDIDATE
        env:
          GITHUB_TOKEN: ${{ secrets.token }}