name: testing-env-image

on:
  push:
    branches:
      - 'main'
      - 'release-**'
  pull_request:
    branches:
      - 'main'
      - 'release-**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changes:
    permissions:
      contents: read  # for dorny/paths-filter to fetch a list of changed files
      pull-requests: read  # for dorny/paths-filter to read pull requests
    outputs:
      should-run-build: ${{ steps.changes.outputs.src == 'true' }}
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
        with:
          egress-policy: audit

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
        id: changes
        with:
          filters: |
            src:
              - 'testing/**'
              - '.github/workflows/testing-env-image.yml'

  build:
    needs: [changes]
    if: needs.changes.outputs.should-run-build == 'true'
    name: Build Testing Env Image
    runs-on: ubuntu-24.04
    permissions:
      packages: write # for ghcr.io push
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
      with:
        egress-policy: audit

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
      with:
        image: tonistiigi/binfmt:latest
        platforms: arm64,arm

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3

    - name: Login to Packages Container registry
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - run: echo "TODAY=$(date +"%Y.%m.%d")" >> $GITHUB_ENV
    - name: Build and push testing-env:${{env.TODAY}} image
      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
      with:
        cache-from: type=gha
        cache-to: type=gha,mode=max
        context: testing
        platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
        push: ${{ github.event_name != 'pull_request' }}
        tags: |
           ghcr.io/runatlantis/testing-env:${{env.TODAY}}
           ghcr.io/runatlantis/testing-env:latest

  skip-build:
    needs: [changes]
    if: needs.changes.outputs.should-run-build == 'false'
    name: Build Testing Env Image
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
        with:
          egress-policy: audit

      - run: 'echo "No build required"'