docker-gitea-act-runner/.github/workflows/build.yml

# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
# SPDX-FileContributor: Sebastian Thomschke
# SPDX-License-Identifier: Apache-2.0
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-gitea-act-runner
#
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
name: Build

on:
  push:
    branches-ignore:  # build all branches except:
    - 'dependabot/**'  # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
    tags-ignore:  # don't build tags
    - '**'
    paths-ignore:
    - '**/*.md'
    - '.editorconfig'
    - '.git*'
    - '.github/*.yml'
    - '.github/workflows/stale.yml'
  schedule:
    # https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
    - cron: '0 17 * * 3'
  pull_request:
  workflow_dispatch:
    inputs:
      VERSION:
        type: string
        default: latest
        description: Version of the Gitea Act Runner, see https://dl.gitea.com/act_runner/ 
    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/

defaults:
  run:
    shell: bash

env:
  DOCKER_IMAGE_REPO: ${{ github.repository_owner }}/gitea-act-runner
  TRIVY_CACHE_DIR: ~/.trivy/cache

jobs:
  build:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        include:
          - DOCKER_IMAGE_FLAVOR: dood
            DOCKER_IMAGE_TAG_PREFIX: ""
            GITEA_ACT_RUNNER_VERSION: latest
          - DOCKER_IMAGE_FLAVOR: dind
            DOCKER_IMAGE_TAG_PREFIX: dind-
            GITEA_ACT_RUNNER_VERSION: latest
          - DOCKER_IMAGE_FLAVOR: dind-rootless
            DOCKER_IMAGE_TAG_PREFIX: dind-rootless-
            GITEA_ACT_RUNNER_VERSION: latest
          - DOCKER_IMAGE_FLAVOR: dood
            DOCKER_IMAGE_TAG_PREFIX: ""
            GITEA_ACT_RUNNER_VERSION: nightly
          - DOCKER_IMAGE_FLAVOR: dind
            DOCKER_IMAGE_TAG_PREFIX: dind-
            GITEA_ACT_RUNNER_VERSION: nightly
          - DOCKER_IMAGE_FLAVOR: dind-rootless
            DOCKER_IMAGE_TAG_PREFIX: dind-rootless-
            GITEA_ACT_RUNNER_VERSION: nightly
      fail-fast: true

    steps:
    - name: Show environment variables
      run: env | sort

    - name: Git Checkout
      uses: actions/checkout@v4  # https://github.com/actions/checkout

    - name: Check Dockerfile
      uses: hadolint/hadolint-action@v3.1.0
      with:
        dockerfile: image/Dockerfile
        ignore: DL3008,SC1091  # https://github.com/hadolint/hadolint/wiki/DL3008

    - name: Cache trivy cache
      uses: actions/cache@v4
      with:
        path: ${{ env.TRIVY_CACHE_DIR }}
        # https://github.com/actions/cache/issues/342#issuecomment-673371329
        key: ${{ runner.os }}-trivy-${{ github.run_id }}
        restore-keys: |
          ${{ runner.os }}-trivy-          

    - name: Configure fast APT repository mirror
      uses: vegardit/fast-apt-mirror.sh@v1

    - name: Install dos2unix
      run: sudo apt-get install --no-install-recommends -y dos2unix

    - name: "Determine if docker images shall be published"
      run: |
        # ACT -> https://nektosact.com/usage/index.html#skipping-steps
        set -x
        if [[ $GITHUB_REF_NAME == 'main' && $GITHUB_EVENT_NAME != 'pull_request' && -z "$ACT" ]]; then
          echo "DOCKER_PUSH_GHCR=true" >> "$GITHUB_ENV"
          if [[ -n "${{ secrets.DOCKER_HUB_USERNAME }}" ]]; then
            echo "DOCKER_PUSH=true" >> "$GITHUB_ENV"
          fi
        fi        

    - name: Install regclient
      if: ${{ env.DOCKER_PUSH_GHCR }}
      uses: iarekylew00t/regctl-installer@v1

    - name: Login to docker.io
      if: ${{ env.DOCKER_PUSH }}
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_HUB_USERNAME }}
        password: ${{ secrets.DOCKER_HUB_TOKEN }}

    - name: Login to ghcr.io
      if: ${{ env.DOCKER_PUSH_GHCR }}
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ github.token }}

    - name: Build ${{ env.DOCKER_IMAGE_REPO }}:${{ env.DOCKER_IMAGE_TAG }}
      env:
        DOCKER_IMAGE_TAG_PREFIX: ${{ matrix.DOCKER_IMAGE_TAG_PREFIX }}
        DOCKER_IMAGE_FLAVOR: ${{ matrix.DOCKER_IMAGE_FLAVOR }}
        TRIVY_GITHUB_TOKEN: ${{ github.token }}
      run: |
        if [[ -n "${{ inputs.VERSION }}" ]]; then
           export GITEA_ACT_RUNNER_VERSION="${{ inputs.VERSION }}"
        else
           export GITEA_ACT_RUNNER_VERSION="${{ matrix.GITEA_ACT_RUNNER_VERSION }}"
        fi
        bash build-image.sh        

    - name: Delete untagged images
      uses: actions/github-script@v7
      if: ${{ env.DOCKER_PUSH_GHCR }}
      continue-on-error: true
      with:
        github-token: ${{ secrets.GHA_DELETE_PACKAGES }}
        script: |
          const imageName = /[^/]*$/.exec(process.env.DOCKER_IMAGE_REPO)[0]
          const basePath = `/orgs/${{ github.repository_owner }}/packages/container/${imageName}/versions`
          for (version of (await github.request(`GET ${basePath}`, { per_page: 100 })).data) {
            if (version.metadata.container.tags.length == 0) {
              console.log(`deleting ${version.name}...`)
              const delResponse = await github.request(`DELETE ${basePath}/${version.id}`)
              console.log(`status: ${delResponse.status}`)
            }
          }