build.yaml

name: Build

on:
  - push

permissions:
  contents: read
  id-token: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    services:
      test_db:
        image: postgres:16
        env:
          POSTGRES_USER: sgs
          POSTGRES_PASSWORD: sgs-pass
        ports:
          - 5433:5432
        volumes:
          - test_data:/var/lib/postgresql/data

    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v11
      - uses: DeterminateSystems/magic-nix-cache-action@v6

      - name: Run tests
        run: nix develop -c make check

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - uses: DeterminateSystems/nix-installer-action@v11
      - uses: DeterminateSystems/magic-nix-cache-action@v6

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build image
        run: nix build -L .#image

      - uses: actions/upload-artifact@v4
        with:
          name: image
          path: result

      - name: Push image
        if: github.ref_type == 'tag'
        run: |
          image="$(docker load -i result | awk '{print $3}')"
          <<< "$TAGS" xargs -n1 docker tag "$image"
          <<< "$TAGS" xargs -n1 docker push
        env:
          TAGS: ${{ steps.meta.outputs.tags }}