images-branch.yml

name: Branch images
env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
on:  # yamllint disable-line rule:truthy
  pull_request:
    branches:
      - main
    types:
      - synchronize
  pull_request_review:
    types:
      - submitted
  workflow_dispatch:
    inputs:
      pr:
        required: true
        type: string
        description: PR number

jobs:
  approval:
    runs-on: ubuntu-latest
    outputs:
      decision: ${{ steps.decision.outputs.decision }}
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          submodules: recursive

      - name: Set PR
        run: echo "PR=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
        if: github.event_name != 'workflow_dispatch'

      - name: Set PR (forks)
        run: echo "PR=${{ inputs.pr }}" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch'

      # Skips push-updater-images by setting an output
      - name: Check if pull request is approved
        id: decision
        run: |
          DECISION=$(gh pr view ${{ env.PR }} --json reviewDecision,state -t '{{.reviewDecision}}:{{.state}}')
          echo "decision=$DECISION" >> $GITHUB_OUTPUT

  push-updater-images:
    runs-on: ubuntu-latest
    needs: approval
    if: needs.approval.outputs.decision == 'APPROVED:OPEN' && !github.event.pull_request.head.repo.fork
    strategy:
      fail-fast: false
      matrix:
        suite:
          - { name: bundler, ecosystem: bundler }
          - { name: cargo, ecosystem: cargo }
          - { name: composer, ecosystem: composer }
          - { name: docker, ecosystem: docker }
          - { name: elm, ecosystem: elm }
          - { name: git_submodules, ecosystem: gitsubmodule }
          - { name: github_actions, ecosystem: github-actions }
          - { name: go_modules, ecosystem: gomod }
          - { name: gradle, ecosystem: gradle }
          - { name: hex, ecosystem: mix }
          - { name: maven, ecosystem: maven }
          - { name: npm_and_yarn, ecosystem: npm }
          - { name: nuget, ecosystem: nuget }
          - { name: pub, ecosystem: pub }
          - { name: python, ecosystem: pip }
          - { name: swift, ecosystem: swift }
          - { name: devcontainers, ecosystem: devcontainers }
          - { name: terraform, ecosystem: terraform }
    permissions:
      contents: read
      id-token: write
      packages: write
    env:
      DEPENDABOT_UPDATER_VERSION: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          submodules: recursive

      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Prepare tag
        run: echo "DEPENDABOT_UPDATER_VERSION=${{ github.sha }}" >> $GITHUB_ENV
        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_review'

      - name: Prepare tag (forks)
        run: |
          gh pr checkout ${{ inputs.pr }}
          git fetch origin main
          git merge origin/main --ff-only || exit 1
          git submodule update --init --recursive
          echo "DEPENDABOT_UPDATER_VERSION=$(git rev-parse HEAD)" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch'

      - name: Log in to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build ecosystem image
        run: script/build ${{ matrix.suite.name }}

      - name: Push branch image
        run: |
          docker tag "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}" "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION"
          docker push "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION"
          cosign sign --yes $(cosign triangulate --type=digest "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION")

      - name: Set summary
        run: |
          echo "updater uploaded with tag \`$DEPENDABOT_UPDATER_VERSION\`" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY