name: testing-env-image

on:
  push:
    branches:
      - 'main'
      - 'release-**'
  pull_request:
    branches:
      - 'main'
      - 'release-**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changes:
    permissions:
      contents: read  # for dorny/paths-filter to fetch a list of changed files
      pull-requests: read  # for dorny/paths-filter to read pull requests
    outputs:
      should-run-build: ${{ steps.changes.outputs.src == 'true' }}
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: changes
        with:
          filters: |
            src:
              - 'testing/**'
              - '.github/workflows/testing-env-image.yml'

  build:
    needs: [changes]
    if: needs.changes.outputs.should-run-build == 'true'
    name: Build Testing Env Image
    runs-on: ubuntu-24.04
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
      with:
        egress-policy: audit

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
      with:
        image: tonistiigi/binfmt:latest
        platforms: arm64,arm

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3

    - name: Login to Packages Container registry
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - run: echo "TODAY=$(date +"%Y.%m.%d")" >> $GITHUB_ENV
    - name: Build and push testing-env:${{env.TODAY}} image
      uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
      with:
        cache-from: type=gha
        cache-to: type=gha,mode=max
        context: testing
        platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
        push: ${{ github.event_name != 'pull_request' }}
        tags: |
           ghcr.io/runatlantis/testing-env:${{env.TODAY}}
           ghcr.io/runatlantis/testing-env:latest

  skip-build:
    needs: [changes]
    if: needs.changes.outputs.should-run-build == 'false'
    name: Build Testing Env Image
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: audit

      - run: 'echo "No build required"'