maybe_build.yaml

name: Check if we need to build a new image due to base image update
on:
  schedule:
    - cron: "30 */4 * * *"
  workflow_dispatch:

jobs:
  check:
    name: Check if there's a new version of the base image
    runs-on: ubuntu-latest
    outputs:
      needs_rebuild: ${{ steps.maybe-build.conclusion == 'success' }}
    steps:
      - name: Get SHA of the latest base image present in the repository
        id: registry
        run: |
          REGISTRY_SHA=$(skopeo inspect docker://ghcr.io/ublue-os/aurora-dx:stable | jq '.Digest' )
          echo "SHA=$REGISTRY_SHA" >> $GITHUB_OUTPUT

      - name: Get SHA of the base image from the last successful build
        id: last-build
        run: |
          LAST_BUILD_SHA=$(skopeo inspect docker://ghcr.io/yacoob/yaurora:latest | jq '.Labels."org.opencontainers.image.base.digest"')
          echo "SHA=$LAST_BUILD_SHA" >> $GITHUB_OUTPUT

      - name: Output gathered information
        id: debug-output
        run: |
          echo "aurora-dx:stable is currently at [${{ steps.registry.outputs.SHA }}]"
          echo "yaurora has last been built at aurora-dx:stable's: [${{ steps.last-build.outputs.SHA }}]"

      - name: Decide that we need a new build
        id: maybe-build
        if: steps.last-build.outputs.SHA != steps.registry.outputs.SHA
        run: |
          echo "Verdict: yaurora needs to be rebuilt"

  build:
    permissions:
      contents: read
      packages: write
      id-token: write
    name: Build Custom Image
    needs: check
    if: needs.check.outputs.needs_rebuild == 'true'
    secrets:
      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
    uses: ./.github/workflows/build.yaml