kms-connector-docker-build.yml

name: kms-connector-docker-build

on:
  workflow_call:
    secrets:
      AWS_ACCESS_KEY_S3_USER:
        required: true
      AWS_SECRET_KEY_S3_USER:
        required: true
      BLOCKCHAIN_ACTIONS_TOKEN:
        required: true
      CGR_USERNAME:
        required: true
      CGR_PASSWORD:
        required: true
    outputs:
      db_migration_build_result:
        description: "Result of the build-db-migration job"
        value: ${{ jobs.build-db-migration.result }}
      gw_listener_build_result:
        description: "Result of the build-gw-listener job"
        value: ${{ jobs.build-gw-listener.result }}
      kms_worker_build_result:
        description: "Result of the build-kms-worker job"
        value: ${{ jobs.build-kms-worker.result }}
      tx_sender_build_result:
        description: "Result of the build-tx-sender job"
        value: ${{ jobs.build-tx-sender.result }}
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      build_db_migration:
        description: "Enable/disable build for KMS Connector's DB Migration"
        type: boolean
        default: true
      build_gw_listener:
        description: "Enable/disable build for KMS Connector's Gateway Listener"
        type: boolean
        default: true
      build_kms_worker:
        description: "Enable/disable build for KMS Connector's KMS Worker"
        type: boolean
        default: true
      build_tx_sender:
        description: "Enable/disable build for KMS Connector's Transaction Sender"
        type: boolean
        default: true
  push:
    branches:
      - main

permissions: {}

concurrency:
  group: kms-connector-build-${{ github.ref_name }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  check-changes:
    name: check-changes
    permissions:
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
    runs-on: ubuntu-latest
    outputs:
      changes-db-migration: ${{ steps.filter.outputs.db-migration }}
      changes-gw-listener: ${{ steps.filter.outputs.gw-listener }}
      changes-kms-worker: ${{ steps.filter.outputs.kms-worker }}
      changes-tx-sender: ${{ steps.filter.outputs.tx-sender }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            db-migration:
              - .github/workflows/kms-connector-docker-build.yml
              - kms-connector/connector-db/**
            gw-listener:
              - .github/workflows/kms-connector-docker-build.yml
              - kms-connector/crates/gw-listener/**
              - kms-connector/crates/utils/**
              - kms-connector/Cargo.*
            kms-worker:
              - .github/workflows/kms-connector-docker-build.yml
              - kms-connector/crates/kms-worker/**
              - kms-connector/crates/utils/**
              - kms-connector/Cargo.*
            tx-sender:
              - .github/workflows/kms-connector-docker-build.yml
              - kms-connector/crates/tx-sender/**
              - kms-connector/crates/utils/**
              - kms-connector/Cargo.*

  build-db-migration:
    needs: check-changes
    if: |
      github.event_name == 'release'
      || (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-db-migration == 'true')
      || (github.event_name == 'workflow_dispatch' && inputs.build_db_migration)
    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@6c72e3dbc894744c1e228fb165f4c4d657e475b6 # v1.0.1
    secrets: &docker_secrets
      AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
      AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
      BLOCKCHAIN_ACTIONS_TOKEN: ${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
      CGR_USERNAME: ${{ secrets.CGR_USERNAME }}
      CGR_PASSWORD: ${{ secrets.CGR_PASSWORD }}
    permissions: &docker_permissions
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
      attestations: 'write' # Required to create build attestations
      packages: 'write' # Required to publish Docker images
      id-token: 'write' # Required for OIDC authentication
    with:
      use-cgr-secrets: true
      working-directory: "."
      image-name: "fhevm/kms-connector/db-migration"
      docker-file: "kms-connector/connector-db/Dockerfile"
      app-cache-dir: "fhevm-kms-connector-db-migration"

  build-gw-listener:
    needs: check-changes
    if: |
      github.event_name == 'release'
      || (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-gw-listener == 'true')
      || (github.event_name == 'workflow_dispatch' && inputs.build_gw_listener)
    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@6c72e3dbc894744c1e228fb165f4c4d657e475b6 # v1.0.1
    permissions: *docker_permissions
    secrets: *docker_secrets
    with:
      use-cgr-secrets: true
      working-directory: "."
      image-name: "fhevm/kms-connector/gw-listener"
      docker-file: "./kms-connector/crates/gw-listener/Dockerfile"
      app-cache-dir: "fhevm-kms-connector-gw-listener"

  build-kms-worker:
    needs: check-changes
    if: |
      github.event_name == 'release'
      || (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-kms-worker == 'true')
      || (github.event_name == 'workflow_dispatch' && inputs.build_kms_worker)
    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@6c72e3dbc894744c1e228fb165f4c4d657e475b6 # v1.0.1
    permissions: *docker_permissions
    secrets: *docker_secrets
    with:
      use-cgr-secrets: true
      working-directory: "."
      image-name: "fhevm/kms-connector/kms-worker"
      docker-file: "./kms-connector/crates/kms-worker/Dockerfile"
      app-cache-dir: "fhevm-kms-connector-kms-worker"

  build-tx-sender:
    needs: check-changes
    if: |
      github.event_name == 'release'
      || (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-tx-sender == 'true')
      || (github.event_name == 'workflow_dispatch' && inputs.build_tx_sender)
    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@6c72e3dbc894744c1e228fb165f4c4d657e475b6 # v1.0.1
    permissions: *docker_permissions
    secrets: *docker_secrets
    with:
      use-cgr-secrets: true
      working-directory: "."
      image-name: "fhevm/kms-connector/tx-sender"
      docker-file: "./kms-connector/crates/tx-sender/Dockerfile"
      app-cache-dir: "fhevm-kms-connector-tx-sender"

  re-tag-db-migration-image:
    needs: check-changes
    if: |
      needs.check-changes.outputs.changes-db-migration != 'true' && github.event_name == 'push'
    permissions: &re-tag-image-permissions
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      packages: 'write' # Required to publish Docker images
      id-token: 'write' # Required for OIDC authentication
    uses: ./.github/workflows/re-tag-docker-image.yml
    with:
      image-name: "fhevm/kms-connector/db-migration"
      previous-tag-or-commit: ${{ github.event.before }}
      new-tag-or-commit: ${{ github.event.after }}

  re-tag-gw-listener-image:
    needs: check-changes
    if: |
      needs.check-changes.outputs.changes-gw-listener != 'true' && github.event_name == 'push'
    permissions: *re-tag-image-permissions
    uses: ./.github/workflows/re-tag-docker-image.yml
    with:
      image-name: "fhevm/kms-connector/gw-listener"
      previous-tag-or-commit: ${{ github.event.before }}
      new-tag-or-commit: ${{ github.event.after }}

  re-tag-kms-worker-image:
    needs: check-changes
    if: |
      needs.check-changes.outputs.changes-kms-worker != 'true' && github.event_name == 'push'
    permissions: *re-tag-image-permissions
    uses: ./.github/workflows/re-tag-docker-image.yml
    with:
      image-name: "fhevm/kms-connector/kms-worker"
      previous-tag-or-commit: ${{ github.event.before }}
      new-tag-or-commit: ${{ github.event.after }}

  re-tag-tx-sender-image:
    needs: check-changes
    if: |
      needs.check-changes.outputs.changes-tx-sender != 'true' && github.event_name == 'push'
    permissions: *re-tag-image-permissions
    uses: ./.github/workflows/re-tag-docker-image.yml
    with:
      image-name: "fhevm/kms-connector/tx-sender"
      previous-tag-or-commit: ${{ github.event.before }}
      new-tag-or-commit: ${{ github.event.after }}