build-oci.yaml

#
# Copyright (C) 2025 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
name: oci-builds

on:
  push:
    branches: [ main, "0.8" ]
    tags:
      - '*'
  pull_request:
    branches: [ main ]

jobs:
  build-and-upload:
    name: Build and Upload Images
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-24.04, ubuntu-24.04-arm]
    steps:
      - name: Free Disk Space for Docker
        uses: endersonmenezes/free-disk-space@v3
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
          rm_cmd: "rmz"
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Install Podman (only for arm64)
        if: contains(matrix.os, 'arm')
        run: |
          sudo apt-get update -y
          sudo apt-get -y install podman
      - name: Set environment variables based on architecture
        run: |
          if [[ "${{ matrix.os }}" == *"arm"* ]]; then
            echo "ARCH_TYPE=arm64" >> $GITHUB_ENV
          else
            echo "ARCH_TYPE=amd64" >> $GITHUB_ENV
          fi
      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/')
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
      - name: Log in quay.io
        if: github.event_name == 'push'
        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_IO_USERNAME }}
          password: ${{ secrets.QUAY_IO_PASSWORD }}
      - name: Build image for PR
        if: github.event_name == 'pull_request'
        env:
          IMG: ghcr.io/redhat-developer/mapt:pr-${{ github.event.number }}
        shell: bash
        run: |
          make oci-build-${{ env.ARCH_TYPE }}
          make oci-save-${{ env.ARCH_TYPE }}
      - name: Upload mapt OCI artifacts for PR
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mapt-${{ env.ARCH_TYPE }}
          path: mapt*
      - name: Build and push arch image
        if: github.event_name == 'push'
        run: |
          make oci-build-${{ env.ARCH_TYPE }}
          make oci-push-${{ env.ARCH_TYPE }}
      - name: Extract binary from image
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          IMAGE=quay.io/redhat-developer/mapt:v${VERSION:-1.0.0-dev}-${{ env.ARCH_TYPE }}
          container=$(podman create ${IMAGE})
          podman cp ${container}:/usr/local/bin/mapt ./mapt-linux-${{ env.ARCH_TYPE }}
          podman rm ${container}
      - name: Upload binary artifact
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mapt-linux-${{ env.ARCH_TYPE }}
          path: mapt-linux-${{ env.ARCH_TYPE }}
  combine-artifacts:
    name: combine-artifacts
    needs: build-and-upload
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    steps:
      - name: Download mapt oci flatten images
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: mapt-*
      - name: copy both artifacts into single directory
        env:
          IMG: ghcr.io/redhat-developer/mapt:pr-${{ github.event.number }}
        run: echo ${IMG} > mapt-image
      - name: Upload combined mapt artifacts for PR
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mapt-arm64-and-amd64
          path: mapt-*
  push:
    name: push
    if: github.event_name == 'push'
    needs: build-and-upload
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/')
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
      - name: Log in quay.io
        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_IO_USERNAME }}
          password: ${{ secrets.QUAY_IO_PASSWORD }}
      - name: Push manifest
        run: make oci-push-manifest
  release:
    name: release
    needs: [build-and-upload, push]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - name: Download binary artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: mapt-linux-*
          merge-multiple: true
      - name: Create checksums
        run: sha256sum mapt-linux-* > mapt-checksums.txt
      - name: Get previous release tag
        id: prev
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: echo "tag=$(gh release list --repo "$GITHUB_REPOSITORY" --limit 1 --json tagName --jq '.[0].tagName')" >> "$GITHUB_OUTPUT"
      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          ARGS="--generate-notes"
          if [ -n "${{ steps.prev.outputs.tag }}" ]; then
            ARGS="$ARGS --notes-start-tag ${{ steps.prev.outputs.tag }}"
          fi
          gh release create "$TAG" mapt-linux-* mapt-checksums.txt $ARGS --repo "$GITHUB_REPOSITORY"