---
name: Container - Kanidmd

# This is always built and uploads an OCI image as a build artifact, but only
# pushes to "ghcr.io/kanidm/kanidmd:devel" when on "kanidm/kanidm@master".
on:
  pull_request:
  push:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  kanidmd_build:
    name: Build kanidmd Docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build kanidmd
        uses: docker/build-push-action@v5
        with:
          platforms: "linux/amd64"
          tags: ghcr.io/${{ github.repository_owner }}/kanidmd:devel
          # build-args: |
          #  "KANIDM_BUILD_OPTIONS=-j1"
          file: server/Dockerfile
          # Must use OCI exporter for multi-arch: https://github.com/docker/buildx/pull/1813
          outputs: type=oci,dest=/tmp/kanidmd-docker.tar
      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: kanidmd-docker
          path: /tmp/kanidmd-docker.tar

  kanidmd_push:
    name: Push kanidmd Docker image
    # This step is split so that we don't apply "packages: write" permission
    # except when uploading the final Docker image to GHCR.
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master' && github.repository == 'kanidm/kanidm'
    needs: kanidmd_build
    permissions:
      packages: write

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: kanidmd-docker
          path: /tmp

      - name: Push image to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | oras login -u "${{ github.actor }}" --password-stdin ghcr.io
          oras copy --from-oci-layout "/tmp/kanidmd-docker.tar:devel" "ghcr.io/${{ github.repository_owner }}/kanidmd:devel"