cd-image-api.yml

name: "CD: Image API"

on:
  push:
    tags:
      - "image-api-v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Image API version without the v prefix"
        required: true
        type: string

concurrency:
  group: "image-api-${{ github.event_name == 'workflow_dispatch' && format('image-api-v{0}', inputs.version) || github.ref_name }}"
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      MANUAL_VERSION: ${{ inputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            VERSION="${MANUAL_VERSION}"
          else
            VERSION="${GITHUB_REF_NAME#image-api-v}"
          fi
          if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "invalid Image API version: ${VERSION}" >&2
            exit 1
          fi
          RELEASE_TAG="image-api-v${VERSION}"
          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF_NAME}" != "${RELEASE_TAG}" ]]; then
            echo "unexpected Image API tag: ${GITHUB_REF_NAME}" >&2
            exit 1
          fi
          if ! git show-ref --verify --quiet "refs/tags/${RELEASE_TAG}"; then
            echo "Image API release tag not found: ${RELEASE_TAG}" >&2
            exit 1
          fi
          TAG_COMMIT="$(git rev-list -n 1 "${RELEASE_TAG}")"
          CHECKED_OUT_COMMIT="$(git rev-parse HEAD)"
          if [[ "${TAG_COMMIT}" != "${CHECKED_OUT_COMMIT}" ]]; then
            echo "Image API version ${VERSION} must run from ${RELEASE_TAG}" >&2
            exit 1
          fi
          echo "version=${VERSION}" >>"${GITHUB_OUTPUT}"
          echo "release_tag=${RELEASE_TAG}" >>"${GITHUB_OUTPUT}"
          echo "commit=${TAG_COMMIT}" >>"${GITHUB_OUTPUT}"

      - name: Install Flux CLI 2.9.4
        shell: bash
        run: |
          set -euo pipefail
          curl -fsSLo /tmp/flux.tar.gz \
            https://github.com/fluxcd/flux2/releases/download/v2.9.4/flux_2.9.4_linux_amd64.tar.gz
          echo "c2c397a52930f52d2005c01d276116b059d062de379386d58e98115380a766a2  /tmp/flux.tar.gz" \
            | sha256sum -c -
          tar -xzf /tmp/flux.tar.gz -C /tmp flux
          sudo install -m 0755 /tmp/flux /usr/local/bin/flux
          flux version --client

      - name: Authenticate to GHCR
        shell: bash
        run: |
          echo "${{ github.token }}" | docker login ghcr.io \
            --username "${{ github.actor }}" \
            --password-stdin

      - name: Publish Image API artifact
        env:
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE_TAG: ${{ steps.version.outputs.release_tag }}
          COMMIT: ${{ steps.version.outputs.commit }}
        shell: bash
        run: |
          set -euo pipefail
          ARTIFACT_DESTINATION="oci://ghcr.io/trycua/cua-image-api:v${VERSION}"
          ARTIFACT_REFERENCE="${ARTIFACT_DESTINATION#oci://}"
          set +e
          MANIFEST_OUTPUT="$(docker manifest inspect "${ARTIFACT_REFERENCE}" 2>&1)"
          MANIFEST_STATUS=$?
          set -e
          if [[ "${MANIFEST_STATUS}" -eq 0 ]]; then
            echo "Image API artifact already exists: ${ARTIFACT_DESTINATION}" >&2
            exit 1
          fi
          if ! grep -Eiq 'manifest unknown|no such manifest' <<<"${MANIFEST_OUTPUT}"; then
            echo "could not verify Image API artifact absence: ${ARTIFACT_DESTINATION}" >&2
            printf '%s\n' "${MANIFEST_OUTPUT}" >&2
            exit 1
          fi
          flux push artifact "${ARTIFACT_DESTINATION}" \
            --path=clusters/base/cua-images \
            --source="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
            --revision="${RELEASE_TAG}@sha1:${COMMIT}"