golden-container-images-docker-build-rust.yml

name: golden-container-images-docker-build-rust

on:
  workflow_dispatch:
    inputs:
      push_image:
        description: 'Push the image to the registry'
        default: true
        required: true
        type: boolean
      tag:
        description: 'Tag to use for the image'
        default: 'latest'
        required: true
        type: string
  pull_request:

permissions: {}

concurrency:
  group: golden-rust-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  check-changes:
    name: golden-container-images-docker-build-rust/check-changes
    permissions:
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
    runs-on: ubuntu-latest
    outputs:
      changes-golden-rust: ${{ steps.filter.outputs.golden-rust }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36  # v3.0.2
        id: filter
        with:
          filters: |
            golden-rust:
              - '.github/workflows/golden-container-images-docker-build-rust.yml'
              - 'golden-container-images/rust-glibc/**'
              - toolchain.txt
  determine-tag:
    name: golden-container-images-docker-build-rust/determine-tag
    permissions:
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.set-tag.outputs.tag }}
    steps:
      - name: Checkout Project
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: 'false'
      - id: set-tag
        env:
          TAG: ${{ github.event.inputs.tag }}
          WORKSPACE: ${{ github.workspace }}
        run: |
          if [[ -n "${TAG}" ]]; then
            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          else
            if [[ -f "${WORKSPACE}/toolchain.txt" ]]; then
              echo "tag=$(cat "${WORKSPACE}"/toolchain.txt)" >> "$GITHUB_OUTPUT"
            fi
          fi
  build:
    name: golden-container-images-docker-build-rust/build
    needs: [check-changes, determine-tag]
    if: ${{ needs.check-changes.outputs.changes-golden-rust == 'true' }}
    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@6c72e3dbc894744c1e228fb165f4c4d657e475b6 # v1.0.1
    secrets:
      AWS_ACCESS_KEY_S3_USER: ${{ secrets.AWS_ACCESS_KEY_S3_USER }}
      AWS_SECRET_KEY_S3_USER: ${{ secrets.AWS_SECRET_KEY_S3_USER }}
      BLOCKCHAIN_ACTIONS_TOKEN: ${{ secrets.BLOCKCHAIN_ACTIONS_TOKEN }}
      CGR_USERNAME: ${{ secrets.CGR_USERNAME }}
      CGR_PASSWORD: ${{ secrets.CGR_PASSWORD }}
    permissions:
      actions: 'read' # Required to read workflow run information
      contents: 'read' # Required to checkout repository code
      pull-requests: 'read' # Required to read pull request information
      attestations: 'write' # Required to create build attestations
      packages: 'write' # Required to publish Docker images
      id-token: 'write' # Required for OIDC authentication
    with:
      use-cgr-secrets: true
      working-directory: "."
      push_image: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.push_image == 'true' || github.event_name != 'workflow_dispatch' && true }}
      image-name: "fhevm/gci/rust-glibc"
      image-tag: ${{ needs.determine-tag.outputs.tag }}
      docker-file: "./golden-container-images/rust-glibc/Dockerfile"
      app-cache-dir: "fhevm-golden-rust"
      ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', github.event.inputs.tag) || '' }}