push.yml

name: Build and push Docker image

on:
  release:
    types: [published]

env:
  DOCKER_BUILD_ARGS: --cache-from type=gha --cache-to type=gha
  DOCKER_BUILDKIT: 1
  BUILDX_CONTAINER: container

permissions:
  id-token: write
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-22.04
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout

    steps:
      - name: Checkout main project
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive

      - name: Expose Docker environment variables for gha cache
        # This action takes in the ID tokens etc provided by the permissions,
        # as well as some environment data, and exposes them to future steps
        # in the correct locations and formats for their use with the `gha`
        # GitHub Actions cache for Docker.
        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0

      - name: Setup Docker
        run: docker buildx create --use --name container --driver docker-container

      - name: Set up JDK
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'temurin'
          java-version-file: .java-version
          cache: 'maven'

      - name: 'Az CLI login'
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # Azure Login Action v3.0.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: 'Docker login'
        run:
          az acr login --name ${{ secrets.AZURE_CONTAINER_REGISTRY_NAME }}

      - name: Set up necessary SGX stuff
        run: sudo ./c/docker/sgx_runtime_libraries.sh

      - name: Build and push container image
        run: |
          ./mvnw -e -B deploy \
            -Dpackaging=docker \
            -Djib.to.image="${{ secrets.REGISTRY_LOGIN_SERVER }}/cdsi:${GITHUB_REF_NAME}"