main.yaml

name: Create docker image

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    paths-ignore:
    - "*.md"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      actions: read
      pull-requests: read
    steps:
      - uses: "actions/checkout@v4"
        with:
          fetch-depth: 0
      - name: Find start and end SHAs
        uses: nrwl/nx-set-shas@v4
        id: last-successful-commit-push
        with:
          main-branch-name: main
      - name: Determine what to do
        id: changed-files
        shell: python
        env:
          RESOURCES: nais/nais.yaml,nais/topic.yaml
        run: |
          import os
          import glob
          from itertools import chain
          import subprocess
          
          changed_files=set(subprocess.run(["git", "diff", "--name-only", "${{ steps.last-successful-commit-push.outputs.base }}", "${{ steps.last-successful-commit-push.outputs.head }}"], capture_output=True, text=True).stdout.splitlines())
          print(f"::debug::Changed files: {changed_files}")
          resource_files = set(chain(*(glob.glob(f) for f in os.getenv("RESOURCES", "").split(","))))
          print(f"::debug::Resource files: {resource_files}")

          if changed_files < resource_files:
            print("Only resources have been changed")
            output = "only-resources"
          elif resource_files.isdisjoint(changed_files):
            print("No resources have been changed")
            output = "non-resources"
          else:
            output = "all"
          
          with open(os.getenv("GITHUB_OUTPUT"), "a") as f:
            f.write(f"changed={output}\n")
      - uses: nais/platform-build-push-sign@main
        id: build-push-sign
        if: steps.changed-files.outputs.changed != 'only-resources'
        with:
          name: karapace
          google_service_account: gh-karapace
          push: ${{ github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/main' }}
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
    outputs:
      image: "${{ steps.build-push-sign.outputs.tag }}"
  deploy:
    name: "deploy for testing"
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11" # ratchet:actions/checkout@v2
      - uses: nais/deploy/actions/deploy@v2
        env:
          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
          CLUSTER: dev-gcp
          RESOURCE: nais/nais.yaml,nais/topic.yaml
          WORKLOAD_IMAGE: ${{ needs.build.outputs.image }}