image-github-runner-ci.yml

---
name: Build GitHub Runner CI Image

on: # yamllint disable-line rule:truthy
  push:
    branches:
      - main
    paths:
      - .github/workflows/image-github-runner-ci.yml
      - images/github-runner-ci/**
    tags:
      - github-runner-ci-*
  pull_request:
    branches:
      - main
    paths:
      - .github/workflows/image-github-runner-ci.yml
      - images/github-runner-ci/**

jobs:
  build-github-runner-ci:
    name: Build GitHub Runner CI Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      run_job_container_test: ${{ steps.image_export.outputs.push }}
      tag: ${{ steps.version_tag.outputs.tag }}

    steps:
      - name: Checkout Repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Login to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Compute Version Tag
        env:
          BRANCH: ${{ github.ref_type == 'tag' && github.ref_name || github.event_name != 'pull_request' && format('{0}.{1}.{2}', github.run_id, github.run_number, github.run_attempt) || format('pr-{0}.{1}.{2}.{3}', github.event.number, github.run_id, github.run_number, github.run_attempt) }}
        id: version_tag
        run: echo "tag=$BRANCH" | sed -e 's/github-runner-ci-//' >> "$GITHUB_OUTPUT"
      - name: Select Image Export Mode
        id: image_export
        env:
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
        run: |
          set -euo pipefail

          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" && "${HEAD_REPOSITORY}" != "${GITHUB_REPOSITORY}" ]]; then
            echo "load=true" >> "$GITHUB_OUTPUT"
            echo "push=false" >> "$GITHUB_OUTPUT"
          else
            echo "load=false" >> "$GITHUB_OUTPUT"
            echo "push=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Generate Metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: metadata
        with:
          images: ghcr.io/${{ github.repository_owner }}/github-runner-ci
      - name: Build Image
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: images/github-runner-ci
          file: images/github-runner-ci/Containerfile
          labels: ${{ steps.metadata.outputs.labels }}
          load: ${{ steps.image_export.outputs.load }}
          push: ${{ steps.image_export.outputs.push }}
          tags: ghcr.io/${{ github.repository_owner }}/github-runner-ci:${{ steps.version_tag.outputs.tag }}
      - name: Smoke Test Image
        run: |
          docker run --rm ghcr.io/${{ github.repository_owner }}/github-runner-ci:${{ steps.version_tag.outputs.tag }} bash -lc '
            test "$(id -u):$(id -g)" = "1001:1001"
            test "$HOME" = "/home/runner"
            test -w "$HOME"
            test -w "$HOME/.local"
            test -w "$HOME/.local/bin"
            test -w "$HOME/.local/share"
            brew --version
            git --version
            just --version
            jq --version
            rg --version
            shellcheck --version
            yq --version
          '

  test-github-actions-job-container:
    name: Test GitHub Actions Job Container
    needs: build-github-runner-ci
    if: ${{ needs.build-github-runner-ci.outputs.run_job_container_test == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    container:
      image: ghcr.io/${{ github.repository_owner }}/github-runner-ci@${{ needs.build-github-runner-ci.outputs.digest }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    steps:
      - name: Checkout Repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Verify Actions Job Container
        shell: bash
        run: |
          set -euo pipefail

          echo "uid_gid=$(id -u):$(id -g)"
          echo "user=$(id -un):$(id -gn)"
          echo "HOME=${HOME}"
          echo "GITHUB_WORKSPACE=${GITHUB_WORKSPACE}"
          echo "RUNNER_TEMP=${RUNNER_TEMP}"

          test "${GITHUB_ACTIONS}" = "true"
          test "$(id -u):$(id -g)" = "1001:1001"
          test "$(id -un):$(id -gn)" = "runner:runner"
          test -w "${HOME}"
          mkdir -p "${HOME}/.local/bin" "${HOME}/.local/share"
          test -w "${HOME}/.local/bin"
          test -w "${HOME}/.local/share"
          test -w "${GITHUB_WORKSPACE}"
          test -w "${RUNNER_TEMP}"

          brew --version
          brew install hello
          brew list --versions hello
          hello --version

          touch "${GITHUB_WORKSPACE}/.github-runner-ci-write-test"
          rm "${GITHUB_WORKSPACE}/.github-runner-ci-write-test"
          printf 'github-runner-ci job container test\n' > "${RUNNER_TEMP}/github-runner-ci.txt"

          test -f "${GITHUB_WORKSPACE}/justfile"
          test "$(git -C "${GITHUB_WORKSPACE}" rev-parse --is-inside-work-tree)" = "true"
          git -C "${GITHUB_WORKSPACE}" status --short
          git --version
          just --version
          jq --version
          rg --version
          shellcheck --version
          yq --version