containers.build.yaml

name: "Containers: Test-and-Build"

on:
  workflow_dispatch:
  push:
    branches:
    - main
    paths:
    - 'apps/**'
    - 'dev/**'
    - 'base/**'
    - ".github/workflows/containers.build.yaml"
  pull_request:
    paths:
    - 'apps/**'
    - 'dev/**'
    - 'base/**'
    - ".github/workflows/containers.build.yaml"

# Detect which folders in project-root (which contain the containers) contain changes
jobs:
  changes:
    name: Get changes
    runs-on: ubuntu-latest
    outputs:
      matrix: "{\"container\": ${containers} }"
    steps:
    - name: Checkout
      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
    - uses: dorny/paths-filter@v2
      id: filter
      with:
        list-files: json
        filters: |
          changed:
          - 'apps/**'
          - 'dev/**'
          - 'base/**'
    - run: echo '${{ toJson(steps.filter.outputs) }}' > changes.json
    - id: reduce
      run: |
        CONTAINERS=$(jq --raw-output '.changed_files | fromjson | .[] |= sub("(?<filepath>(?<first_directory>(?<root1>[/]?)[^/]+/)(?<second_directory>(?<root2>[/]?)[^/]+)(?<extra_paths>.+))"; "\(.second_directory)") | unique' changes.json)
        echo "containers=${CONTAINERS}" >> "$GITHUB_ENV"

  hadolint:
    name: Run hadolint
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
    - name: hadolint
      uses: reviewdog/action-hadolint@f7d29ec6dd89022747bd18b5a151b62ac2f1555e # v1.36.0
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        reporter: github-pr-review
        filter_mode: diff_context
        fail_on_error: true

  build:
    permissions:
      actions: read # for detecting the Github Actions environment.
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for uploading attestations.
    name: Build
    runs-on: ubuntu-latest
    needs:
    - hadolint
    - changes
    strategy:
      matrix: ${{ fromJson(needs.changes.outputs.matrix) }}
      fail-fast: false
    if: "!contains(github.event.head_commit.message, '[ci-skip]')"
    steps:
    - name: Checkout
      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4

# NOTE
# many of this code was copied from the great workflow of truechats/containers
# https://github.com/truecharts/containers/blob/master/.github/workflows/containers.build.yaml