deploy_image.yaml

name: Reusable Image Deploy

on:
  workflow_call:
    inputs:
      quayRepository:
        description: The quay repository to upload the image to. The repository must belong to the dockstore quay organization.
        required: true
        type: string
      dockerContext:
        description: The Docker context containing the Docker file of the image to build and push.
        required: false
        default: .
        type: string
      buildArgs:
        description: Build arguments used to build the Docker image
        required: false
        type: string
      changelist:
        description: 'Patch and pre-release metadata. Example: ".0-alpha.1"'
        required: false
        type: string

env:
  DOCKER_IMAGE_NAME: quay.io/dockstore/${{ inputs.quayRepository }}

permissions:
  id-token: write
  contents: read

jobs:
  deploy_image:
    name: Deploy image to quay.io/dockstore/${{ inputs.quayRepository }}
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      # Step that does that actual cache save and restore
      - uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
           ${{ runner.os }}-maven-

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: '21.0.2+13.0.LTS'
          distribution: 'adopt'

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-session-name: docker_checksum_upload_from_github
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Login to Quay.io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USER }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Build without changelist
        if: ${{ inputs.changelist == '' }}
        run: ./mvnw -B clean install -DskipTests

      - name: Build with changelist
        if: ${{ inputs.changelist != '' }}
        run: |
          ./mvnw -B clean install -DskipTests -Dchangelist=${{ inputs.changelist }}

      - name: Set folder name
        run: |
          S3_FOLDER=${{ github.ref_name }}
          echo "S3_FOLDER=${S3_FOLDER//\//_}" >> $GITHUB_ENV

      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          context: ${{ inputs.dockerContext }}
          push: true
          tags: '${{ env.DOCKER_IMAGE_NAME }}:${{ env.S3_FOLDER }}'
          build-args: |
            ${{ inputs.buildArgs }}

      - name: Create checksums
        run: |
          docker inspect ${{ env.DOCKER_IMAGE_NAME }}:${{ env.S3_FOLDER }} | grep -A 1 RepoDigests
          docker inspect ${{ env.DOCKER_IMAGE_NAME }}:${{ env.S3_FOLDER }} | grep -A 1 RepoDigests | grep -oPm1 'sha256:\K\w+' > image-digest.txt        

      - name: Get short SHA
        id: slug
        run: echo "::set-output name=sha7::$(echo ${GITHUB_SHA} | cut -c1-7)"

      - name: Copy checksum files
        run: aws s3 cp image-digest.txt  s3://${{ secrets.AWS_BUCKET }}/${{ env.S3_FOLDER }}-${{ steps.slug.outputs.sha7 }}/${{ inputs.quayRepository }}/image-digest.txt