build.yaml

name: Build

env:
  DOCKER_IMAGE: cardanosolutions/kupo

on:
  pull_request:
    branches: [ "master" ]
  push:
    branches: [ "master", "release/v*" ]
    tags: [ "*.*.*" ]

jobs:
  build:
    strategy:
      matrix:
        os: [ linux, macos ]
        arch: [ x86_64, aarch64 ]
        compiler: [ ghc948 ]
        exclude:
          - os: macos
            arch: x86_64

    runs-on: ${{ matrix.arch == 'x86_64' && 'buildjet-4vcpu-ubuntu-2204' || (matrix.os == 'linux' && 'buildjet-16vcpu-ubuntu-2204-arm' || 'macos-latest') }}
    steps:

    - name: 📥 Checkout repository
      uses: actions/checkout@v3
      with:
        submodules: true

    - name: Tag build artifacts
      id: tag
      shell: bash
      run: |
        if [ "${GITHUB_REF/refs\/tags\//}" == "refs/heads/master"  ]; then
          echo "value=$GIT_SHA" >> $GITHUB_OUTPUT
        else
          echo "value=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
        fi
      env:
        GIT_SHA: ${{ github.sha }}

    - name: ❄️ Install Nix
      uses: cachix/install-nix-action@v22
      with:
        extra_nix_config: |
          trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
          substituters = https://cache.iog.io/ https://cache.nixos.org/
        nix_path: nixpkgs=channel:nixos-unstable

    - name: 🧊 Prepare Cache
      shell: bash
      run: |
        make configure

    - name: 💾 Cache
      uses: actions/cache@v3
      with:
        path: |
          ~/.cabal-static/packages
          ~/.cabal-static/store
        key: cabal-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.compiler }}-${{ hashFiles('cabal.project.freeze') }}
        restore-keys: |
          cabal-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.compiler }}

    - name: 🔨 Build
      run: |
        make
      env:
        GIT_SHA: ${{ github.sha }}

    - name: 🔎 Verify
      run: |
        ./dist/bin/kupo --version
        ./dist/bin/kupo +RTS --info -RTS

    - name: 📎 Upload Artifact
      uses: actions/upload-artifact@v3
      with:
        name: kupo-${{ steps.tag.outputs.value }}-${{ matrix.arch }}-${{ matrix.os }}
        path: |
          dist/bin
          dist/share

  docker:
    needs: [ build ]

    strategy:
      matrix:
        os: [ linux ]
        arch: [ x86_64, aarch64 ]

    runs-on: ${{ matrix.os == 'linux' && 'ubuntu-latest' }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3
      with:
        submodules: true

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.DOCKER_IMAGE }}
        tags: |
          type=raw,value=latest,enable={{is_default_branch}}
          type=semver,pattern=v{{version}}

    - name: Tag build artifacts
      id: tag
      shell: bash
      run: |
        if [ "${GITHUB_REF/refs\/tags\//}" == "refs/heads/master" ]; then
          echo "value=$GIT_SHA" >> $GITHUB_OUTPUT
        else
          echo "value=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
        fi
      env:
        GIT_SHA: ${{ github.sha }}

    - name: hadolint
      uses: hadolint/hadolint-action@v3.0.0
      with:
        dockerfile: "./Dockerfile"
        failure-threshold: warning
        ignore: DL3059, SC2086, DL3029

    - name: Login to DockerHub
      if: ${{ github.event_name == 'push' }}
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}

    - name: Download
      uses: actions/download-artifact@v3
      with:
        name: kupo-${{ steps.tag.outputs.value }}-${{ matrix.arch }}-${{ matrix.os }}

    - name: Build and push (latest)
      if: ${{ github.event_name == 'push' }}
      id: build
      uses: docker/build-push-action@v3
      with:
        context: .
        platforms: ${{ matrix.os }}/${{ matrix.arch == 'x86_64' && 'amd64' || 'arm64' }}
        target: kupo
        cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }}:latest
        cache-to: type=inline
        outputs: type=image,name=${{ env.DOCKER_IMAGE }},push-by-digest=true,name-canonical=true,push=true

    - name: Export digest
      if: ${{ github.event_name == 'push' }}
      run: |
        mkdir -p /tmp/digests
        digest="${{ steps.build.outputs.digest }}"
        touch "/tmp/digests/${digest#sha256:}"

    - name: Upload digest
      if: ${{ github.event_name == 'push' }}
      uses: actions/upload-artifact@v3
      with:
        name: digests
        path: /tmp/digests/*
        if-no-files-found: error
        retention-days: 1

  registry:
    needs: [ docker ]
    runs-on: ubuntu-latest
    steps:
      - name: Download digests
        uses: actions/download-artifact@v3
        with:
          name: digests
          path: /tmp/digests

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.DOCKER_IMAGE }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=semver,pattern=v{{version}}

      - name: Login to DockerHub
        if: ${{ github.event_name == 'push' && steps.meta.outputs.tags != '' }}
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}

      - name: Create manifest list and push
        if: ${{ github.event_name == 'push' && steps.meta.outputs.tags != '' }}
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.DOCKER_IMAGE }}@sha256:%s ' *)

      - name: Inspect image
        if: ${{ github.event_name == 'push' && steps.meta.outputs.tags != '' }}
        run: |
          docker buildx imagetools inspect ${{ env.DOCKER_IMAGE }}:${{ steps.meta.outputs.version }}