image.yaml

---
name: Create OCI image
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    paths-ignore:
      - '.github/styles/**'
      - 'web/**'

permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  publish-image:
    strategy:
      fail-fast: false
      matrix:
        image: [image, nativelink-worker-init, nativelink-worker-lre-cc, nativelink-worker-lre-rs]
        os: [ubuntu-24.04]
        include:
          - os: macos-26
            image: nativelink-worker-lre-rs
    name: Publish ${{ matrix.image }} / ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    permissions:
      packages: write
      id-token: write
      security-events: write
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: >- # v6.0.2
          actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Prepare Worker
        uses: ./.github/actions/prepare-nix
        with:
          nativelink_attic_token: ${{ secrets.NATIVELINK_ATTIC_TOKEN }}

      - name: Test image
        run: |
          nix run .#local-image-test ${{ matrix.image }}

      - name: Upload image
        run: |
          nix run .#publish-ghcr ${{ matrix.image }}
        env:
          GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        if: github.ref == 'refs/heads/main'

      - name: Upload trivy scan results to GitHub Security tab
        uses: >- # v2.16.3
          github/codeql-action/upload-sarif@592977e6ae857384aa79bb31e7a1d62d63449ec5
        with:
          sarif_file: 'trivy-results.sarif'
        if: github.ref == 'refs/heads/main'