---
name: Container - Kanidm

# This is always built and uploads an OCI image as a build artifact, but only
# pushes to "ghcr.io/kanidm/kanidm:devel" when on "kanidm/kanidm@master".
"on":
  pull_request:
  push:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  kanidm_build:
    name: Build kanidm Docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build kanidm
        uses: docker/build-push-action@v5
        with:
          platforms: "linux/amd64"
          tags: ghcr.io/${{ github.repository_owner }}/kanidm:devel
          build-args: |
            "KANIDM_FEATURES="
          #  "KANIDM_BUILD_OPTIONS=-j1"
          file: tools/Dockerfile
          # Must use OCI exporter for multi-arch: https://github.com/docker/buildx/pull/1813
          outputs: type=oci,dest=/tmp/kanidm-docker.tar
      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: kanidm-docker
          path: /tmp/kanidm-docker.tar

  kanidm_push:
    name: Push kanidm Docker image
    # This step is split so that we don't apply "packages: write" permission
    # except when uploading the final Docker image to GHCR.
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master' && github.repository == 'kanidm/kanidm'
    needs: kanidm_build
    permissions:
      packages: write

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: kanidm-docker
          path: /tmp

      - name: Push image to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | oras login -u "${{ github.actor }}" --password-stdin ghcr.io
          oras copy --from-oci-layout "/tmp/kanidm-docker.tar:devel" "ghcr.io/${{ github.repository_owner }}/kanidm:devel"