build.yaml

name: Build container image
# This run-name will contain the branch name when run with pull_request or
# pull_request_target event.
# Otherwise it will contain the tag name if present or SHA.
run-name: Build container image ${{ github.head_ref || ( github.ref_type == 'tag' && github.ref_name || github.sha ) }}

concurrency:
  # Run only for most recent commit in PRs but for all tags and commits on main
  # Ref: https://docs.github.com/en/actions/using-jobs/using-concurrency
  group: ${{ github.workflow }}-${{ github.head_ref || ( github.ref_type == 'tag' && github.ref_name || github.sha ) }}
  cancel-in-progress: true

on:
  push:
    branches:
      - "main"
  pull_request:
    branches:
      - "**"
  workflow_dispatch: {}

permissions:
  contents: read
  actions: read

jobs:
  check-docs-only:
    runs-on: ubuntu-latest
    outputs:
      docs_only: ${{ steps.check-files.outputs.docs_only }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - id: check-files
        name: Check if only documentation files changed
        run: ./scripts/check-docs-only-changes.sh ${{ github.event.pull_request.base.sha || 'HEAD~1' }} ${{ github.sha }}

  build:
    needs: [check-docs-only]
    if: ${{ needs.check-docs-only.outputs.docs_only != 'true' }}
    uses: ./.github/workflows/__build-workflow.yaml
    secrets:
      dockerhub-token: ${{ secrets.DOCKERHUB_PUSH_TOKEN_KO }}
      gh-pat: ${{ secrets.PAT_GITHUB }}
      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
      slack-team-id: ${{ secrets.SLACK_TEAM_ID }}
    with:
      username: ${{ vars.DOCKERHUB_PUSH_USERNAME }}
      registry: docker.io
      image-name: ${{ vars.DOCKERHUB_IMAGE_NAME_KO }}
      # If we pushed then it means we want to build and push the image.
      # Branch filter above will decide pushes to which branch will trigger this.
      push: ${{ github.event.action == 'push' }}
      slack-send: ${{ github.event.action == 'push' }}

  # This job exists to satisfy the required check when only docs change
  passed:
    runs-on: ubuntu-latest
    needs: [check-docs-only]
    if: always()
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit
      - name: Check if docs-only changes
        run: |
          if [[ "${{ needs.check-docs-only.outputs.docs_only }}" == "true" ]]; then
            echo "Only documentation files were changed, skipping build"
            exit 0
          fi

      - name: Check build result
        if: ${{ needs.check-docs-only.outputs.docs_only != 'true' }}
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "Build job failed or was cancelled."
            exit 1
          fi