build.yml

---
name: build-image
on:
  push:
  schedule:
    - cron: 0 18 * * 5
  workflow_dispatch:
env:
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

jobs:
  push-ghcr:
    name: Build and push image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      matrix:
        MAJOR_VERSION: [44]
      fail-fast: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Update build counter
        run: |
          set -x

          if [ "$LAST_RUN_DATE" == "`date +'%Y%m%d'`" ]; then
            echo "BUILD_COUNT=$((BUILD_COUNT + 1))" >> $GITHUB_ENV
          else
            echo "BUILD_COUNT=0" >> $GITHUB_ENV
          fi

          echo "LAST_RUN_DATE=`date +'%Y%m%d'`" >> $GITHUB_ENV
        env:
          BUILD_COUNT: ${{ vars.BUILD_COUNT }}
          LAST_RUN_DATE: ${{ vars.LAST_RUN_DATE }}

      - name: Copy signing key and password
        run: |
          echo "${{ secrets.SIGNING_KEY }}" > cosign.key
          echo "${{ secrets.SIGNING_KEY_PASSWORD }}" > cosign.pwd

      - name: Build image
        run: |
          for attempt in 1 2 3; do
            just build ${{ matrix.MAJOR_VERSION }} && break
            if [ $attempt -eq 3 ]; then exit 1; fi
            echo "Attempt $attempt failed, retrying in 30s..."
            sleep 30
          done

      - name: Push image to registry
        run: |
          for attempt in 1 2 3; do
            just push ${{ matrix.MAJOR_VERSION }} && break
            if [ $attempt -eq 3 ]; then exit 1; fi
            echo "Attempt $attempt failed, retrying in 30s..."
            sleep 30
          done
        env:
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_PASSWORD: ${{ github.token }}

      - name: Clean up secrets
        if: always()
        run: rm --force cosign.key cosign.pwd

      - name: Update build count repository variable
        uses: action-pack/set-variable@v1
        with:
          name: "BUILD_COUNT"
          value: ${{ env.BUILD_COUNT }}
          token: ${{ secrets.SET_VARIABLE_TOKEN }}

      - name: Update last run date repository variable
        uses: action-pack/set-variable@v1
        with:
          name: "LAST_RUN_DATE"
          value: ${{ env.LAST_RUN_DATE }}
          token: ${{ secrets.SET_VARIABLE_TOKEN }}