publish_images.yaml

name: Publish images
on:
  workflow_run:
    workflows: ["Build and test"]
    types: [completed]
    branches: [develop]
env:
  REGISTRY: ghcr.io
  XROAD_HOME: ${{ github.workspace }}
jobs:
  PublishCS:
    name: Publish Central Server image
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Initialize docker setup
        working-directory: ${{ github.workspace }}/Docker/centralserver
        run: ./init_context.sh
      # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
      - name: Download Debian packages
        uses: actions/github-script@v7
        with:
          script: |
            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: context.payload.workflow_run.id,
            });
            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "debian-packages"
            })[0];
            let download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            let fs = require('fs');
            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/debian-packages.zip`, Buffer.from(download.data));
      - name: Unzip Debian packages
        run: mkdir -p ${{ github.workspace }}/Docker/centralserver/build/packages && unzip -d ${{ github.workspace }}/Docker/centralserver/build/packages debian-packages.zip
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: ${{ github.workspace }}/Docker/centralserver
          build-args: |
            PACKAGE_SOURCE=internal
          push: true
          tags: ghcr.io/nordic-institute/xrddev-central-server:latest
      - name: Clean old CS images
        uses: snok/container-retention-policy@v2
        with:
          image-names: xrddev-central-server
          cut-off: 1 week ago UTC
          timestamp-to-use: created_at
          account-type: org
          org-name: nordic-institute
          keep-at-least: 1
          token-type: github-token
          token: ${{ secrets.GITHUB_TOKEN }}
  PublishSS:
    name: Publish Security Server image
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Initialize docker setup
        working-directory: ${{ github.workspace }}/Docker/securityserver
        run: ./init_context.sh
      # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
      - name: Download Debian packages
        uses: actions/github-script@v7
        with:
          script: |
            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: context.payload.workflow_run.id,
            });
            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "debian-packages"
            })[0];
            let download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
            });
            let fs = require('fs');
            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/debian-packages.zip`, Buffer.from(download.data));
      - name: Unzip Debian packages
        run: mkdir -p ${{ github.workspace }}/Docker/securityserver/build/packages && unzip -d ${{ github.workspace }}/Docker/securityserver/build/packages debian-packages.zip
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: ${{ github.workspace }}/Docker/securityserver
          build-args: |
            PACKAGE_SOURCE=internal
          push: true
          tags: ghcr.io/nordic-institute/xrddev-security-server:latest
      - name: Clean old SS images
        uses: snok/container-retention-policy@v2
        with:
          image-names: xrddev-security-server
          cut-off: 1 week ago UTC
          timestamp-to-use: created_at
          account-type: org
          org-name: nordic-institute
          keep-at-least: 1
          token-type: github-token
          token: ${{ secrets.GITHUB_TOKEN }}