build-prod-container.yml

name: Build and Push Prod Image

on:
  pull_request:
  push:
    branches:
      - main
  repository_dispatch:
    types:
      - dispatch-build
  workflow_dispatch:
  workflow_call:
    inputs:
      release_workflow:
        required: false
        type: boolean
        default: false
      tag:
          description: 'Tag to use for the Docker image'
          required: false
          type: string

permissions:
  contents: write

jobs:
  build-base-image:
    runs-on: ubuntu-latest
    steps:
      # For release, the worflow call (from pre-release.yaml) is triggered by a tag push
      # like 7.5.1 Here, we want to set the *branch* name to 7.5.x,
      # which is the branch for a feature version
      - name: Set Branch for Release
        id: set_branch
        if: ${{ inputs.release_workflow }}
        run: |
          echo "branch=${GITHUB_REF_NAME%.*}.x" >> $GITHUB_OUTPUT

      - name: Checkout for release with a tag
        uses: actions/checkout@v4
        if: ${{ inputs.release_workflow }}
        with:
          fetch-depth: 0
          ref: ${{ steps.set_branch.outputs.branch }}

      - name: Checkout for push to main
        uses: actions/checkout@v4
        if: ${{ !inputs.release_workflow }}

      - name: Cache base image
        uses: actions/cache@v4
        with:
          path: /tmp/.base-buildx-cache
          key: base-buildx-${{ github.sha }}-${{ github.run_id }}
          # allow cache hits from previous runs of the current branch,
          # parent branch, then upstream branches, in that order
          restore-keys: |
            base-buildx-

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: --debug

      # Free disk space
      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android  # will release about 10 GB if you don't need Android

      - name: Build and push Docker images
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./images/Dockerfile
          target: final-stage
          build-args: |
            IS_PR_BUILD=${{ github.event_name == 'pull_request' }}
          cache-from: type=local,src=/tmp/.base-buildx-cache
          cache-to: type=local,dest=/tmp/.base-buildx-cache,mode=max

  make-date-tag:
    runs-on: ubuntu-latest
    outputs:
      dtag: ${{ steps.mkdatetag.outputs.dtag }}
    steps:
      - name: make date tag
        id: mkdatetag
        run: echo "dtag=$(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT

  build-server-images:
    needs: [build-base-image, make-date-tag]
    strategy:
      fail-fast: False
      matrix:
        image:
          - cache
          - origin
          - director
          - registry
          - osdf-cache
          - osdf-origin
          - osdf-director
          - osdf-registry
    runs-on: ubuntu-latest

    steps:
      # For release, the worflow call (from pre-release.yaml) is triggered by a tag push
      # like 7.5.1 Here, we want to set the *branch* name to 7.5.x,
      # which is the branch for a feature version
      - name: Set Branch for Release
        id: set_branch
        if: ${{ inputs.release_workflow }}
        run: |
          echo "branch=${GITHUB_REF_NAME%.*}.x" >> $GITHUB_OUTPUT

      - name: Checkout for release with a tag
        uses: actions/checkout@v4
        if: ${{ inputs.release_workflow }}
        with:
          fetch-depth: 0
          ref: ${{ steps.set_branch.outputs.branch }}

      - name: Checkout for push to main
        uses: actions/checkout@v4
        if: ${{ !inputs.release_workflow }}

      - name: Determine Latest Version Tag
        id: latest_version
        run: |
          git fetch --tags
          tags=$(git tag -l 'v*.*.*' | sort -V)
          highest_tag=$(echo "${tags}" | tail -n1)
          echo "Highest version tag is ${highest_tag}"
          if [[ "${GITHUB_REF##*/}" == "${highest_tag}" ]]; then
            echo "IS_LATEST=true" >> $GITHUB_OUTPUT
          else
            echo "IS_LATEST=false" >> $GITHUB_OUTPUT
          fi

      - name: Generate tag list
        id: generate-tag-list
        env:
          TIMESTAMP: ${{ needs.make-date-tag.outputs.dtag }}
        # Here, we either tag the container with the "latest" tag if
        # the commit that triggered this action doesn't have a tag,
        # or we tag it with the commit's tag if one exists
        run: |
          IS_LATEST=${{ steps.latest_version.outputs.IS_LATEST }}
          # Check if we're working with a tagged version
          if [ -z "${{ inputs.tag }}" ]
          then
            # Use regex to check for a semver tag match
            if [[ ${GITHUB_REF##*/} =~ v[0-9]+\.[0-9]+\.[0-9]+ ]]
            then
              GITHUB_TAG=${GITHUB_REF##*/}
            else
              GITHUB_TAG="latest-dev"
            fi
          else
            GITHUB_TAG=${{ inputs.tag }}
          fi

          echo "Master SHA:"
          echo $(git rev-parse $GITHUB_REF_NAME)

          echo "Current SHA:"
          echo $(git rev-parse HEAD)

          echo $GITHUB_TAG

          docker_repo="pelican_platform"
          image_name=${{ matrix.image }}
          tag_list=()
          for registry in hub.opensciencegrid.org; do
            for image_tag in "$GITHUB_TAG"; do
              tag_list+=("$registry/$docker_repo/$image_name":"$image_tag")
            done
          done
          if [[ "$IS_LATEST" == "true" ]]; then
            tag_list+=("$registry/$docker_repo/$image_name:latest")
          fi
          # This causes the tag_list array to be comma-separated below,
          # which is required for build-push-action
          IFS=,
          echo "taglist=${tag_list[*]}" >> $GITHUB_OUTPUT

      - name: Load cached base image
        uses: actions/cache@v4
        with:
          path: /tmp/.base-buildx-cache
          key: base-buildx-${{ github.sha }}-${{ github.run_id }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: --debug

        # We only login to OSG harbor and push the image
        # if the workflow was for the release
      - name: Log in to OSG Harbor
        uses: docker/login-action@v3
        if: github.repository == 'PelicanPlatform/pelican' && inputs.release_workflow
        with:
          registry: hub.opensciencegrid.org
          username: ${{ secrets.PELICAN_HARBOR_ROBOT_USER }}
          password: ${{ secrets.PELICAN_HARBOR_ROBOT_PASSWORD }}

      - name: Build and push Docker images
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./images/Dockerfile
          push: ${{ github.repository == 'PelicanPlatform/pelican' && (inputs.release_workflow || false) }}
          tags: "${{ steps.generate-tag-list.outputs.taglist }}"
          target: ${{ matrix.image }}
          build-args: |
            IS_PR_BUILD=${{ github.event_name == 'pull_request' }}
          cache-from: type=local,src=/tmp/.base-buildx-cache