build.yml

name: Build

on:
  workflow_dispatch:
  pull_request:
    branches:
      - '**'

env:
  DOCKER_BUILDKIT: '1'

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  contents: read
  actions: read
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    name: 01-build.sh
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run 01-build.sh
        run: ./deploy-scripts/01-build.sh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          IMAGE_TAG: ga-${{ github.run_number }}
          TRUST_STORE_PASSWORD: ${{ secrets.TRUST_STORE_PASSWORD }}

  lint:
    name: 02-lint.sh
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4.2.1
      - name: Run 02-lint.sh
        run: ./deploy-scripts/02-lint.sh

  push_image:
    name: 03-push-image.sh
    if: github.event_name == 'workflow_dispatch'
    needs: [ lint, build ]
    permissions:
      packages: write
      id-token: write
      contents: read
    runs-on: 'ubuntu-24.04'
    steps:
      - name: Fetch history for all branches and tags
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Push image
        uses: ./.github/actions/push_image
        with:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          aws-arn: ${{ secrets.AWS_AOE_UTILITY_ROLE_ARN }}
          image-tag: ga-${{ github.run_number }}