unstable.yaml

name: Unstable Release

on:
  push:
    branches:
      - 'main'
    tags-ignore:
      - '*'
    paths-ignore:
      - 'demo/**'
      - 'docs/**'
      - 'examples/**'
      - 'helm/ggbridge/README.md'
      - 'LICENSE'
      - 'README.md'
      - 'SECURITY.md'
  workflow_dispatch:
    inputs:
      runner:
        description: "Specify the runner to use"
        required: true
        default: "ubuntu-latest"

permissions:
  contents: read
  packages: write
  attestations: write
  id-token: write

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  DAGGER_VERSION: '0.16.1'

jobs:
  docker:
    if: github.ref == 'refs/heads/main'

    name: Push Docker image
    runs-on: ${{ github.event_name == 'workflow_dispatch' && inputs.runner || 'ubuntu-latest' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Get GitHub vars
        id: github
        uses: ./.github/actions/github

      - name: Build APK packages
        id: apk
        uses: ./.github/actions/melange/build
        with:
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

      - name: Publish prod image
        id: publish-prod
        uses: ./.github/actions/apko/publish
        with:
          config: 'apko/prod.yaml'
          tag: '${{ steps.github.outputs.repository }}:unstable'
          repository-append: ${{ steps.apk.outputs.output-dir }}
          keyring-append: ${{ steps.apk.outputs.public-key }}
          dockerhub-username: ${{ vars.DOCKER_REGISTRY_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

      - name: Sign prod image
        id: sign-prod
        uses: ./.github/actions/cosign/sign
        with:
          image: '${{ steps.github.outputs.repository }}@${{ steps.publish-prod.outputs.digest }}'
          dockerhub-username: ${{ vars.DOCKER_REGISTRY_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
          cosign-private-key: ${{ secrets.COSIGN_PRIVATE_KEY }}
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

      - name: Publish shell images
        id: publish-shell
        uses: ./.github/actions/apko/publish
        with:
          config: 'apko/shell.yaml'
          tag: '${{ steps.github.outputs.repository }}:unstable-shell'
          repository-append: ${{ steps.apk.outputs.output-dir }}
          keyring-append: ${{ steps.apk.outputs.public-key }}
          dockerhub-username: ${{ vars.DOCKER_REGISTRY_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

      - name: Sign shell image
        id: sign-shell
        uses: ./.github/actions/cosign/sign
        with:
          image: '${{ steps.github.outputs.repository }}@${{ steps.publish-shell.outputs.digest }}'
          dockerhub-username: ${{ vars.DOCKER_REGISTRY_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
          cosign-private-key: ${{ secrets.COSIGN_PRIVATE_KEY }}
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

      - name: Scan vulnerabilities
        id: scan
        uses: ./.github/actions/scan
        with:
          source: 'ghcr.io/${{ steps.github.outputs.repository }}:unstable'
          severity-cutoff: high
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

  helm:
    if: github.ref == 'refs/heads/main'

    name: Push Helm Chart
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Get GitHub vars
        id: github
        uses: ./.github/actions/github

      - name: Test Helm chart
        uses: ./.github/actions/helm/test
        with:
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}

      - name: Publish Helm chart
        uses: ./.github/actions/helm/publish
        with:
          registry: ghcr.io/${{ steps.github.outputs.repository }}/helm
          version: '0.0.0'
          app-version: 'unstable'
          dagger-version: ${{ env.DAGGER_VERSION }}
          dagger-cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}