rust-docker.yml

name: Build and Push Agent Image to GCR
on:
  push:
    branches: [main]
    tags:
      - '**'
  pull_request:
    paths:
      - 'rust/**'
      - '.github/workflows/rust-docker.yml'
  workflow_dispatch:
    inputs:
      include_arm64:
        description: 'Include arm64 in the build'
        required: false
        default: 'false'
concurrency:
  group: build-push-agents-${{ github.ref }}
  cancel-in-progress: true
jobs:
  check-env:
    runs-on: ubuntu-latest
    # assign output from step to job output
    outputs:
      gcloud-service-key: ${{ steps.gcloud-service-key.outputs.defined }}
    steps:
      - id: gcloud-service-key
        # assign GCLOUD_SERVICE_KEY to env for access in conditional
        env:
          GCLOUD_SERVICE_KEY: ${{ secrets.GCLOUD_SERVICE_KEY }}
        if: "${{ env.GCLOUD_SERVICE_KEY != '' }}"
        # runs if GCLOUD_SERVICE_KEY is defined, so we set the output to true
        run: echo "defined=true" >> $GITHUB_OUTPUT

  build-and-push-to-gcr:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      pull-requests: write

    # uses check-env to determine if secrets.GCLOUD_SERVICE_KEY is defined
    needs: [check-env]
    if: needs.check-env.outputs.gcloud-service-key == 'true'
    steps:
      - name: Generate GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}

      - uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Generate tag data
        id: taggen
        run: |
          set -euo pipefail
          echo "TAG_DATE=$(date +'%Y%m%d-%H%M%S')" >> $GITHUB_OUTPUT
          echo "TAG_SHA=$(echo '${{ github.event.pull_request.head.sha || github.sha }}' | cut -b 1-7)" >> $GITHUB_OUTPUT
          # For tag events, derive pure semver:
          if [ "${{ github.ref_type }}" = "tag" ]; then
            NAME="${{ github.ref_name }}"
            # Strip agents- prefix and any leading v
            NAME="${NAME#agents-}"
            NAME="${NAME#v}"
            # Basic semver guard (allows prerelease/build metadata)
            if echo "$NAME" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+'; then
              echo "SEMVER=$NAME" >> $GITHUB_OUTPUT
              # Check if this is a stable release (no prerelease suffix like -beta, -rc, -alpha)
              if echo "$NAME" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
                echo "IS_STABLE=true" >> $GITHUB_OUTPUT
              else
                echo "IS_STABLE=false" >> $GITHUB_OUTPUT
              fi
            fi
          fi
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: |
            gcr.io/abacus-labs-dev/hyperlane-agent
          # generate Docker tags based on the following events/attributes
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=ref,event=tag
            type=semver,pattern={{version}},value=${{ steps.taggen.outputs.SEMVER }},enable=${{ github.ref_type == 'tag' && steps.taggen.outputs.SEMVER != '' }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.taggen.outputs.SEMVER }},enable=${{ github.ref_type == 'tag' && steps.taggen.outputs.IS_STABLE == 'true' }}
            type=raw,value=${{ steps.taggen.outputs.TAG_SHA }}-${{ steps.taggen.outputs.TAG_DATE }}
      - name: Set up Depot CLI
        uses: depot/setup-action@v1
      - name: Login to GCR
        uses: docker/login-action@v3
        with:
          registry: gcr.io
          username: _json_key
          password: ${{ secrets.GCLOUD_SERVICE_KEY }}
      - name: Determine platforms
        id: determine-platforms
        run: |
          if [ "${{ github.event.inputs.include_arm64 }}" == "true" ]; then
            echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
          else
            echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
          fi
      - name: Build and push
        id: build
        uses: depot/build-push-action@v1
        with:
          project: czmkmn2km1
          context: .
          file: ./rust/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ steps.determine-platforms.outputs.platforms }}

      - name: Comment image tags on PR
        if: github.event_name == 'pull_request' && always()
        uses: ./.github/actions/docker-image-comment
        with:
          comment_tag: rust-agent-docker-image
          image_name: Rust Agent Docker Image
          emoji: 🦀
          image_tags: ${{ steps.meta.outputs.tags }}
          pr_number: ${{ github.event.pull_request.number }}
          github_token: ${{ steps.generate-token.outputs.token }}
          job_status: ${{ job.status }}