From f284003f92f9146d13180ed7e676546dd2c374b2 Mon Sep 17 00:00:00 2001
From: Harald Hoyer <harald@matterlabs.dev>
Date: Wed, 12 Jun 2024 13:50:06 +0200
Subject: [PATCH] ci: fix and revise docker push strategy

- containers are not `latest` by default anymore
- `latest` tag is only set on push to main branch
- buildid tag is only set on push to main branch, and
  changed to the infra repo soonish
- added the missing `vault-unseal` and `vault-admin` container

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
---
 .github/workflows/nix.yml | 47 ++++++++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index af13702f..f783ab1a 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -51,7 +51,6 @@ jobs:
 
   push_to_docker:
     needs: build
-    if: ${{ github.event_name == 'push' }}
     runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.config.nixpackage }}
@@ -60,11 +59,13 @@ jobs:
       fail-fast: false
       matrix:
         config:
-          - { nixpackage: 'container-vault-sgx-azure', dockerfile: 'packages/container-vault-sgx-azure/Dockerfile', repository: 'teepot-vault' }
-          - { nixpackage: 'container-vault-unseal-sgx-azure', dockerfile: 'packages/container-vault-unseal-sgx-azure/Dockerfile', repository: 'teepot-tvu' }
-          - { nixpackage: 'container-vault-admin-sgx-azure', dockerfile: 'packages/container-vault-admin-sgx-azure/Dockerfile', repository: 'teepot-tva' }
-          - { nixpackage: 'container-self-attestation-test-sgx-dcap', dockerfile: 'packages/container-self-attestation-test-sgx-dcap/Dockerfile', repository: 'teepot-self-attestation-test-sgx-dcap' }
-          - { nixpackage: 'container-self-attestation-test-sgx-azure', dockerfile: 'packages/container-self-attestation-test-sgx-azure/Dockerfile', repository: 'teepot-self-attestation-test-sgx-azure' }
+          - { nixpackage: 'container-vault-sgx-azure' }
+          - { nixpackage: 'container-vault-unseal-sgx-azure' }
+          - { nixpackage: 'container-vault-admin-sgx-azure' }
+          - { nixpackage: 'container-vault-unseal' }
+          - { nixpackage: 'container-vault-admin' }
+          - { nixpackage: 'container-self-attestation-test-sgx-dcap' }
+          - { nixpackage: 'container-self-attestation-test-sgx-azure' }
           - { nixpackage: 'container-verify-attestation-sgx' }
     steps:
       - uses: actions/checkout@v4
@@ -86,30 +87,36 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Load and Push nix container
+      - name: Load container
+        id: build
         run: |
           nix build  -L .#${{ matrix.config.nixpackage }}
           export IMAGE_TAG=$(docker load < result | grep -Po 'Loaded image.*: \K.*')
+          echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "IMAGE_NAME=${IMAGE_TAG%:*}" >> "$GITHUB_OUTPUT"
+
+      - name: Push container
+        run: |
           echo "Pushing image ${IMAGE_TAG} to Docker Hub"
-          docker tag "${IMAGE_TAG}" matterlabsrobot/"${IMAGE_TAG}"
+          docker tag "${{ steps.build.outputs.IMAGE_TAG }}" matterlabsrobot/"${IMAGE_TAG}"
           docker push matterlabsrobot/"${IMAGE_TAG}"
-          docker tag matterlabsrobot/"${IMAGE_TAG}" matterlabsrobot/"${IMAGE_TAG%:*}:latest"
-          docker push matterlabsrobot/"${IMAGE_TAG%:*}:latest"
+
+      - name: Tag container as latest
+        if: ${{ github.event_name == 'push' ||  github.event_name == 'schedule' }}
+        run: |
+          docker tag "${{ steps.build.outputs.IMAGE_TAG }}" matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}:latest"
+          docker push matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}:latest"
 
       - name: Generate build ID for Flux Image Automation
-        if: ${{ matrix.config.dockerfile }}
+        if: ${{ github.event_name == 'push' ||  github.event_name == 'schedule' }}
         id: buildid
         run: |
           sha=$(git rev-parse --short HEAD)
           ts=$(date +%s%N | cut -b1-13)
           echo "BUILD_ID=${sha}-${ts}" >> "$GITHUB_OUTPUT"
 
-      - name: Build and Push Container
-        if: ${{ matrix.config.dockerfile }}
-        uses: docker/build-push-action@v5
-        with:
-          file: ${{ matrix.config.dockerfile }}
-          tags: |
-            "matterlabsrobot/${{ matrix.config.repository }}:latest"
-            "matterlabsrobot/${{ matrix.config.repository }}:${{ steps.buildid.outputs.BUILD_ID }}"
-          push: ${{ github.event_name == 'push' ||  github.event_name == 'schedule' }}
+      - name: Push Docker image to matterlabs-infra
+        if: ${{ github.event_name == 'push' ||  github.event_name == 'schedule' }}
+        run: |
+          docker tag "${{ steps.build.outputs.IMAGE_TAG }}" matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}::${{ steps.buildid.outputs.BUILD_ID }}"
+          docker push matterlabsrobot/"${{ steps.build.outputs.IMAGE_NAME }}::${{ steps.buildid.outputs.BUILD_ID }}"