get-changed.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Get Changed Images"

on:
  workflow_call:
    inputs:
      # When true, we skip the GHCR existence check and return all candidates (useful for nightly force builds)
      force:
        type: boolean
        required: false
        default: false
    outputs:
      addedOrModified:
        description: "Whether any files were added or modified"
        value: ${{ jobs.get-changed-images.outputs.addedOrModified }}
      addedOrModifiedImages:
        description: "Comma-separated list of image dirs that need a build (pre-filter)"
        value: ${{ jobs.get-changed-images.outputs.addedOrModifiedImages }}
      imagesToBuildJson:
        description: "JSON matrix of images that actually need building after GHCR existence check"
        value: ${{ jobs.get-changed-images.outputs.imagesToBuildJson }}
      imagesToBuildCount:
        description: "Count of images to build"
        value: ${{ jobs.get-changed-images.outputs.imagesToBuildCount }}

jobs:
  get-changed-images:
    name: Get Changed Images
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    outputs:
      addedOrModified: "${{ steps.changed-files.outputs.all_changed_and_modified_files_count > 0 }}"
      addedOrModifiedImages: "${{ steps.changed-containers.outputs.addedOrModifiedImages }}"
      imagesToBuildJson: "${{ steps.filter-existing.outputs.matrix }}"
      imagesToBuildCount: "${{ steps.filter-existing.outputs.count }}"
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Get Changed Files
        id: changed-files
        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47
        with:
          files: images/**
          json: true
          escape_json: false

      - name: Determine changed images
        id: changed-containers
        shell: bash
        run: |-
          set -euo pipefail

          if [[ "${{ steps.changed-files.outputs.all_changed_and_modified_files_count }}" == "0" ]]; then
            echo "addedOrModifiedImages=" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if jq -r '.[]' <<< '${{ steps.changed-files.outputs.all_changed_and_modified_files }}' \
              | grep -qx 'images/base/common.yaml'; then
            mapfile -t all < <(find images -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | sort -u)
            mapfile -t have_apko < <(printf '%s\n' "${all[@]}" | while read -r d; do
              [[ -f "images/$d/apko.yaml" ]] && echo "$d"
            done)
            printf "addedOrModifiedImages=%s\n" "$(IFS=, ; echo "${have_apko[*]}")" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          CHANGED_JSON='${{ steps.changed-files.outputs.all_changed_and_modified_files }}'
          mapfile -t dirs < <(jq -r '.[]' <<< "$CHANGED_JSON" \
              | awk -F/ '/^images\/[^/]+\/./ {print $2}' \
              | sort -u)

          mapfile -t have_apko < <(printf '%s\n' "${dirs[@]}" | while read -r d; do
            [[ -f "images/$d/apko.yaml" ]] && echo "$d"
          done)

          printf "addedOrModifiedImages=%s\n" "$(IFS=, ; echo "${have_apko[*]}")" >> "$GITHUB_OUTPUT"

      - name: Build candidate matrix
        id: candidates
        if: ${{ steps.changed-containers.outputs.addedOrModifiedImages != '' }}
        shell: bash
        run: |
          set -euo pipefail
          IFS=, read -r -a names <<< '${{ steps.changed-containers.outputs.addedOrModifiedImages }}'

          build_row() {
            local name="$1"
            local file="images/${name}/apko.yaml"
            local ver=""
            ver=$(awk '
              inAnn && $0 ~ /^[^ ]/ { inAnn=0 }
              /^(annotations:)/ { inAnn=1; next }
              inAnn && $0 ~ /org\.opencontainers\.image\.version:/ {
                sub(/.*org\.opencontainers\.image\.version:[[:space:]]*"?/,""); sub(/"$/,""); print; exit
              }' "$file" || true)
            if [[ -z "${ver:-}" ]]; then
              ver=$(grep -E '^[[:space:]]*-[[:space:]]*[a-zA-Z0-9_.+-]+=[0-9][0-9A-Za-z._-]*' "$file" \
                    | head -1 | sed -E 's/.*=([0-9A-Za-z._-]+).*/\1/') || true
            fi
            ver=${ver:-latest}
            jq -n --arg n "$name" --arg v "$ver" \
              --arg c "images/$name/apko.yaml" \
              '{name:$n, version:$v, config:$c}'
          }

          rows=$(for n in "${names[@]}"; do build_row "$n"; done | jq -c -s .)
          echo "json=$rows" >> "$GITHUB_OUTPUT"
          echo "count=$(jq -r 'length' <<<"$rows")" >> "$GITHUB_OUTPUT"

      # If NOTHING changed, bootstrap: consider ALL images with apko.yaml
      - name: Build candidate matrix (all images for bootstrap)
        id: candidates-all
        if: ${{ steps.changed-containers.outputs.addedOrModifiedImages == '' }}
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t names < <(find images -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | sort -u)
          # keep only those with apko.yaml
          mapfile -t names < <(printf '%s\n' "${names[@]}" | while read -r d; do
            [[ -f "images/$d/apko.yaml" ]] && echo "$d"
          done)

          build_row() {
            local name="$1"
            local file="images/${name}/apko.yaml"
            local ver=""
            ver=$(awk '
              inAnn && $0 ~ /^[^ ]/ { inAnn=0 }
              /^(annotations:)/ { inAnn=1; next }
              inAnn && $0 ~ /org\.opencontainers\.image\.version:/ {
                sub(/.*org\.opencontainers\.image\.version:[[:space:]]*"?/,""); sub(/"$/,""); print; exit
              }' "$file" || true)
            if [[ -z "${ver:-}" ]]; then
              ver=$(grep -E '^[[:space:]]*-[[:space:]]*[a-zA-Z0-9_.+-]+=[0-9][0-9A-Za-z._-]*' "$file" \
                    | head -1 | sed -E 's/.*=([0-9A-Za-z._-]+).*/\1/') || true
            fi
            ver=${ver:-latest}
            jq -n --arg n "$name" --arg v "$ver" \
              --arg c "images/$name/apko.yaml" \
              '{name:$n, version:$v, config:$c}'
          }

          if [[ "${#names[@]}" -eq 0 ]]; then
            echo 'json=[]' >> "$GITHUB_OUTPUT"
            echo 'count=0' >> "$GITHUB_OUTPUT"
            exit 0
          fi

          rows=$(for n in "${names[@]}"; do build_row "$n"; done | jq -c -s .)
          echo "json=$rows" >> "$GITHUB_OUTPUT"
          echo "count=$(jq -r 'length' <<<"$rows")" >> "$GITHUB_OUTPUT"

      # Filter candidates by GHCR tag existence unless force==true
      - name: Filter out images that already exist in GHCR
        id: filter-existing
        if: ${{ (steps.candidates.outputs.count != '0') || (steps.candidates-all.outputs.count != '0') }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        env:
          FORCE: ${{ inputs.force }}
          OWNER: ${{ github.repository_owner }}
          REPO: ${{ github.event.repository.name || github.repository }}
          # Prefer "changed" candidates; fallback to "all" candidates
          CANDIDATES: ${{ steps.candidates.outputs.json || steps.candidates-all.outputs.json }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          result-encoding: string
          script: |-
            const force = (process.env.FORCE || 'false') === 'true';
            const repoFull = process.env.REPO?.includes('/') ? process.env.REPO : `${process.env.OWNER}/${process.env.REPO}`;
            const candidates = JSON.parse(process.env.CANDIDATES || '[]');

            if (force) {
              core.info('Force mode enabled — skipping GHCR existence check.');
              const matrix = { include: candidates.map(x => ({ name: x.name, config: x.config, version: x.version })) };
              core.setOutput('matrix', JSON.stringify(matrix));
              core.setOutput('count', String(matrix.include.length));
              return;
            }

            // Helper: check if tag exists by hitting GHCR registry. We treat 200 as "exists".
            // 404 => missing; anything else (401/403/5xx) => include to be safe.
            async function tagMissing(image, tag) {
              const url = `https://${image.replace('ghcr.io/','ghcr.io/v2/')}/manifests/${encodeURIComponent(tag)}`;
              const res = await fetch(url, {
                method: 'HEAD',
                headers: {
                  // NOTE: GHCR registry expects a bearer token via challenge flow; we don't do that here.
                  // For private repos this usually yields 401/403, which we interpret as "include to be safe".
                  'Accept': [
                    'application/vnd.oci.image.index.v1+json',
                    'application/vnd.oci.image.manifest.v1+json',
                    'application/vnd.docker.distribution.manifest.v2+json'
                  ].join(', ')
                }
              });
              if (res.status === 200) return false;      // exists
              if (res.status === 404) return true;       // missing
              core.warning(`Non-404 status ${res.status} for ${url} — will include to be safe.`);
              return true;                                // include to be safe
            }

            const keep = [];
            for (const item of candidates) {
              const image = `ghcr.io/${repoFull}/${item.name}`;
              const tag = item.version;

              const missing = await tagMissing(image, tag);
              if (missing) {
                core.info(`MISSING → ${image}:${tag} (build)`);
                keep.push(item);
              } else {
                core.info(`EXISTS  → ${image}:${tag} (skip)`);
              }
            }

            const matrix = { include: keep.map(x => ({ name: x.name, config: x.config, version: x.version })) };
            core.setOutput('matrix', JSON.stringify(matrix));
            core.setOutput('count', String(matrix.include.length));