cd.yaml

name: cd

on:
  push:
    tags:
      - 'v*'
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  container:

    runs-on: ubuntu-24.04

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
    - name: Login to Github Packages
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Build
      id: docker_build
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
      with:
        load: true
    - name: Smoke test
      run: |
        docker run --rm ${{ steps.docker_build.outputs.imageid }} python -c "from app import main"
    - name: Extract metadata (tags, labels) for Docker
      if: github.event_name != 'pull_request'
      id: meta
      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
    - name: Build and push
      if: github.event_name != 'pull_request'
      id: docker_push
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
      with:
        push: false
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}