publish-commit-image.yaml

name: "Publish Commit Image"
on:
  push:
    branches:
      - main

permissions: {}

concurrency:
  group: publish-commit-image
  cancel-in-progress: false

jobs:
  check-gate:
    permissions:
      checks: read # required for getting the status of specific check names
      contents: read # needed for using the wait-for-check action upstream
    uses: anchore/workflows/.github/workflows/check-gate.yaml@7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 # v0.8.0
    with:
      # these checks run in validations.yaml on every push to main.
      # we do NOT want to publish a commit image if these have not passed on this commit.
      checks: '["Static Analysis", "Test Gate"]'

  # note: the name for this check is referenced in release.yaml (wait-for-preprod), do not change here without changing there
  publish:
    name: Publish Pre-Prod
    runs-on: runs-on=${{ github.run_id }}/cpu=2/ram=4+8/family=t4g+t3a+t3+m6g+m6a/spot=price-capacity-optimized/retry=when-interrupted
    needs: [check-gate]
    environment: preprod
    permissions:
      contents: read
      # package write permission is needed for publishing commit images
      packages: write
    steps:
      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc #v2.2.0
        if: ${{ vars.TRACK_RESOURCE_METRICS != '' }}
        with:
          metrics: ${{ vars.TRACK_RESOURCE_METRICS }}

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
        with:
          # in order to properly resolve the version from git
          fetch-depth: 0
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap

      - name: Login to ghcr.io
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
        run: |
          echo "$GITHUB_TOKEN" | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin

      - name: Build assets
        run: make build

      - name: Publish commit image
        run: make ci-publish-commit