build-push-tag.yml

name: Reusable workflow for building and pushing images

on:
  workflow_call:
    inputs:
      push:
        required: true
        type: boolean
      tag:
        required: true
        type: boolean


env:
  DOCKER_BUILDKIT: 1
  REGISTRY_IMAGE: "${{ github.repository_owner }}/${{ github.event.repository.name }}"
  GHCR_PREFIX: "ghcr.io"
  DOCKER_HUB_PREFIX: "docker.io"
  DOCKER_IMAGE_BUILD_ORDER: "base-legacy base-source2 legacy hlds srcds source2"

jobs:
  build-scan-push-tag:
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v4
        if: ${{ inputs.push || inputs.tag }}

      - name: Build all images
        if: ${{ inputs.push }}
        run: |
          for docker_image in ${DOCKER_IMAGE_BUILD_ORDER}; do
            docker pull ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest || true
            docker buildx bake -f docker-compose.yml ${docker_image}
          done

      - name: Log in to GHCR
        if: ${{ inputs.push || inputs.tag }}
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        if: ${{ inputs.push || inputs.tag }}
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_ACCESS }}

      - name: Push latest images to registries
        if: ${{ inputs.push }}
        run: |
          docker_images=$(docker-compose config --services | paste -sd " " -)

          for docker_image in ${docker_images}; do
            local_image=$(echo ${REGISTRY_IMAGE} | tr '/' '-')

            docker tag ${local_image}:${docker_image} ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest
            docker tag ${local_image}:${docker_image} ${DOCKER_HUB_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest

            docker push ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest
            docker push ${DOCKER_HUB_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest
          done

      - name: Push tagged images to registries
        if: ${{ inputs.tag }}
        run: |
          docker_images=$(docker-compose config --services | paste -sd " " -)

          for docker_image in ${docker_images}; do
            docker pull ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest

            docker tag ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-${{ github.ref_name }}
            docker tag ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-latest ${DOCKER_HUB_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-${{ github.ref_name }}

            docker push ${GHCR_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-${{ github.ref_name }}
            docker push ${DOCKER_HUB_PREFIX}/${REGISTRY_IMAGE}:${docker_image}-${{ github.ref_name }}
          done

      # Copied and modified from k0sctl: https://github.com/xdeb-org/xdeb-install/blob/main/.github/workflows/release.yml
      - name: Add safe git directory
        if: ${{ inputs.tag }}
        run: git config --global --add safe.directory /__w/steamcmd/*

      ## Ugly hack to get the tag name
      ## github.ref gives the full reference like refs.tags.v0.0.1-beta1
      - name: Get branch name to draft release
        if: ${{ inputs.tag }}
        id: branch_name
        run: |
          echo "TAG_NAME=${GITHUB_REF#refs/tags/}" >> ${GITHUB_OUTPUT}

      - name: Unshallow git history
        if: ${{ inputs.tag }}
        env:
          TAG_NAME: ${{ steps.branch_name.outputs.TAG_NAME }}
        run: |
          git fetch --unshallow
          git checkout ${TAG_NAME}

      - name: Generate changelog
        if: ${{ inputs.tag }}
        run: ./scripts/changelog.sh

      - name: Draft release
        if: ${{ inputs.tag }}
        uses: softprops/action-gh-release@v1
        with:
          body_path: public/changelog.md
          tag_name: ${{ steps.branch_name.outputs.TAG_NAME }}
          name: ${{ steps.branch_name.outputs.TAG_NAME }}
          draft: true # So we can manually edit before publishing
          prerelease: false