build.yml

name: "Build"

on:
  - "push"
  - "workflow_dispatch"

concurrency:
  group: "build-${{ github.ref }}"
  cancel-in-progress: true

permissions:
  contents: "read"
  packages: "write"

jobs:
  set-matrix:
    name: "⊹"
    runs-on: "ubuntu-latest"
    outputs:
      matrix: "${{ steps.set-matrix.outputs.matrix }}"
    steps:
      - uses: "actions/checkout@v3"

      - uses: "ruby/setup-ruby@v1"
        with:
          ruby-version: "3.1"

      - id: "set-matrix"
        run: rake github:actions:matrix

  build-rubies:
    name: "${{ matrix.short-slug }}"
    needs: "set-matrix"
    runs-on: "ubuntu-latest"
    strategy:
      fail-fast: false
      matrix: "${{ fromJson(needs.set-matrix.outputs.matrix) }}"
    steps:
      - uses: "actions/checkout@v3"

      # We use qemu so Ruby can be built without a baseruby, we make sure to
      # uninstall it before testing so we can assert things work without it.
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Docker meta
        uses: docker/metadata-action@v4
        id: meta
        with:
          images: ${{ matrix.docker.repo }}
          tags: type=sha

      - name: Build and push (args)
        uses: actions/github-script@v6
        id: args
        with:
          script: |
            const arr = (val) => val.join("\n");
            const obj = (val) => arr(Object.entries(val).map(([k, v]) => `${k}=${v}`));

            const tags = ${{ toJson(matrix.docker.tags) }};
            const tagSlug = tags[tags.length - 1].replace(/[^a-zA-Z0-9]/g, '-');
            const cacheScope = `${process.env.GITHUB_REF_NAME}-${tagSlug}`;
            const buildArgs = ${{ toJson(matrix.docker.build-args) }};

            if (process.env.GITHUB_REF_NAME == null) {
              throw new Error('GITHUB_REF_NAME is not set');
            }

            if (process.env.GITHUB_REF_NAME !== 'main') {
              buildArgs['FORCE_DISABLE_XRUBIES_PKG_CHECK'] = "true";
            }

            core.setOutput('args', {
              'context': '.',
              'push': false,
              'load': true,
              'file': "${{ matrix.docker.file }}",
              'platforms': ${{ toJson(matrix.docker.platforms) }}.join(','),
              'build-args': obj(buildArgs),
              'tags': arr(tags),
              'labels': obj(${{ toJson(matrix.docker.labels) }}) + "\n" + ${{ toJson(steps.meta.outputs.labels) }},
              'cache-from': `type=gha,scope=${cacheScope}`,
              'cache-to': `type=gha,mode=max,scope=${cacheScope}`
            });

      - name: Build and push
        uses: docker/build-push-action@v3
        with: ${{ fromJson(steps.args.outputs.args) }}

      - name: Test
        uses: actions/github-script@v6
        with:
          script: |
            core.info('::info::Disabling binfmt_misc for testing');
            await exec.exec('docker run --privileged --rm tonistiigi/binfmt --uninstall qemu-*');

            const tags = ${{ toJson(matrix.docker.tags) }};

            for (const tag of tags) {
              core.info(`Testing image ${tag}`);
              const exitCode = await exec.exec(`bin/test --image ${tag}`);

              if (exitCode !== 0) {
                core.setFailed(`${tag} did not pass tests`);
              }
            }

      - uses: "./.github/actions/xrubies-scan"
        with:
          image: ${{ matrix.docker.tags[0] }}
          upload-to-github: false

      - name: Login to GitHub Container Registry
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push to GitHub Container Registry
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/github-script@v6
        with:
          script: |
            const tags = ${{ toJson(matrix.docker.tags) }};

            await Promise.all(tags.map((tag) => {
              return core.group(`Pushing ${tag}`, () => exec.exec(`docker push ${tag}`));
            }));