webhook.yml

name: webhook
on:
  workflow_dispatch:
  pull_request:
    paths:
      - operator/webhook/**
      - .github/workflows/webhook.yml
      - .github/workflows/scripts
  push:
    branches:
      - main
    paths:
      - operator/webhook/**

env:
  WORKING_DIR: ./operator/webhook

jobs:
  verify-versions:
    if: github.ref != 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: sh .github/workflows/scripts/verify_webhook_releasable.sh
        name: Verify webhook is in a state to be released on merge
  test:
    name: unit test
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - run: python3 -m pip install -r requirements.txt
      - run: python3 -m pip install -r requirements-dev.txt
      - run: make test

  build:
    name: build image
    needs: test
    if: github.ref != 'refs/heads/main'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
        with:
          context: ${{ env.WORKING_DIR }}
          platforms: linux/amd64,linux/arm64
          push: false

  release:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ${{ env.WORKING_DIR }}
    permissions:
      contents: write # create git tags
      packages: write # push docker images
    steps:
      - uses: actions/checkout@v4
      - run: |
          REGISTRY=$(make get-registry)
          IMAGE_NAME=$(make get-image-name)
          GIT_TAG=$(make get-tag)
          echo "REGISTRY=$REGISTRY" >> "$GITHUB_OUTPUT"
          echo "TAG_NAME=$GIT_TAG" >> "$GITHUB_OUTPUT"
          echo "FULL_IMAGE_NAME=$IMAGE_NAME" >> "$GITHUB_OUTPUT"
          cat $GITHUB_OUTPUT
        id: naming-selector
        name: generate names for artifacts

      - run: |
          git fetch --tags
          if git rev-parse -q --verify "refs/tags/${{ steps.naming-selector.outputs.TAG_NAME }}"; then
            # confirm image exists
            docker manifest inspect ${{ steps.naming-selector.outputs.FULL_IMAGE_NAME }}
          else
            echo "needs_release=true" >> $GITHUB_ENV
          fi
        name: check if release is needed

      - uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
        if: env.needs_release == 'true'
        with:
          registry: ${{ steps.naming-selector.outputs.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        if: env.needs_release == 'true'
        uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
        if: env.needs_release == 'true'
        with:
          context: ${{ env.WORKING_DIR }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.naming-selector.outputs.FULL_IMAGE_NAME }}

      - uses: mathieudutour/github-tag-action@v6.1
        if: env.needs_release == 'true'
        id: tag_version
        with:
          custom_tag: ${{ steps.naming-selector.outputs.TAG_NAME }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          # avoid v prefix before tag
          tag_prefix: ""