build-staging.yaml

name: Build jsinfo (Staging)

# Controls when the workflow will run
on:
  push:
    branches:
      - main
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  main:
    environment: Configure CI/CD
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: 'Authenticate to Google Cloud'
        uses: 'google-github-actions/auth@v1'
        with:
          workload_identity_provider: '${{secrets.staging_workload_identity_provider}}'
          service_account: '${{secrets.staging_service_account}}'

      - name: 'Set up GCP CLI'
        uses: 'google-github-actions/setup-gcloud@v1'

      - name: 'GCP CLI Info'
        run: |
          gcloud info
          gcloud auth list --filter=status:ACTIVE --format="value(account)"

      - name: 'GCP set project'
        env:
          PROJECT_SECRET: ${{secrets.staging_project}}
        run: |
          gcloud config set project "$PROJECT_SECRET"

      - name: 'Authenticate to Google Artifact'
        run: |
          gcloud auth configure-docker us-central1-docker.pkg.dev,europe-west4-docker.pkg.dev

      - name: Set up NOW environment variable
        id: "env-now"
        run: |
          echo "NOW=$(date +'%Y%m%dT%H%M%S')" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Cache Docker layers
        uses: actions/cache@v3
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build, tag, and push docker image to GCP
        env:
          REGISTRY: ${{ secrets.staging_registry }}
          IMAGE_TAG: ${{ github.sha }}
          NOW: ${{ env.NOW }}
        run: |
          docker buildx build -t $REGISTRY:$IMAGE_TAG \
            -t $REGISTRY:$IMAGE_TAG-$NOW \
            --cache-from="type=local,src=/tmp/.buildx-cache" \
            --cache-to="type=local,dest=/tmp/.buildx-cache-new" \
            --push -f Dockerfile .

        # Necessary if you don't want your cache to grow forever, until
        # https://github.com/docker/build-push-action/issues/252
        # https://github.com/moby/buildkit/issues/1896
      - name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache || true
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache || true