container.yml

name: Publish docker container snapshot

on:
  workflow_call:
    inputs:
      ref:
        description: "git ref to checkout to"
        type: string
        default: "master"
      image-name:
        description: "Docker image name"
        type: string
        default: "docker.fluence.dev/nox"
    outputs:
      nox-image:
        description: "nox snapshot image"
        value: ${{ jobs.publish.outputs.image }}

jobs:
  publish:
    name: "Publish snapshot"
    runs-on: ubuntu-latest
    timeout-minutes: 60

    outputs:
      image: "${{ inputs.image-name }}@${{ steps.docker.outputs.digest }}"

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          repository: fluencelabs/nox
          ref: ${{ inputs.ref }}

      - name: Import secrets
        uses: hashicorp/vault-action@v3.0.0
        with:
          url: https://vault.fluence.dev
          path: jwt/github
          role: ci
          method: jwt
          jwtGithubAudience: "https://github.com/fluencelabs"
          jwtTtl: 300
          secrets: |
            kv/hub.docker.com/fluencebot username | DOCKER_HUB_USERNAME ;
            kv/hub.docker.com/fluencebot password | DOCKER_HUB_PASSWORD ;
            kv/docker-registry/basicauth/ci username | DOCKER_USERNAME ;
            kv/docker-registry/basicauth/ci password | DOCKER_PASSWORD

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKER_HUB_USERNAME }}
          password: ${{ env.DOCKER_HUB_PASSWORD }}

      - name: Login to private docker registry
        uses: docker/login-action@v3
        with:
          registry: docker.fluence.dev
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}

      - name: Download nox binary
        uses: actions/download-artifact@v4
        with:
          path: docker/binaries

      - name: Generate snapshot version
        id: version
        uses: fluencelabs/github-actions/generate-snapshot-id@main

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Build and push container snapshot image
        id: docker
        uses: docker/build-push-action@v6
        with:
          context: ./docker
          push: true
          platforms: linux/amd64,linux/arm64
          tags: |
            ${{ inputs.image-name }}:${{ steps.version.outputs.branch }}
            ${{ inputs.image-name }}:${{ steps.version.outputs.branch }}_${{ github.run_number }}_${{ github.run_attempt }}
          labels: |
            branch=${{ steps.version.outputs.branch }}
            sha=${{ steps.version.outputs.sha }}
            run_number=${{ github.run_number }}
            run_attempt=${{ github.run_attempt }}
          cache-from: type=gha
          # github allows only 10GB of cache
          # so save cache only on merge to master
          # to use less space and speed up CI
          cache-to: ${{ github.event_name == 'push' && 'type=gha,mode=max' || '' }}

      - name: Print results to check summary
        if: always()
        run: |
          cat <<'SNAPSHOT' >> $GITHUB_STEP_SUMMARY
          ## nox
          digest: `${{ steps.docker.outputs.digest }}`
          ```
          ${{ inputs.image-name }}:${{ steps.version.outputs.branch }}
          ${{ inputs.image-name }}:${{ steps.version.outputs.branch }}_${{ github.run_number }}_${{ github.run_attempt }}
          ```

          ### Access to Fluence docker registry
          ```
          vault read kv/basicauth/dev
          docker login docker.fluence.dev
          ```
          SNAPSHOT