main.yml

name: Main

permissions:
  contents: read
  packages: write
  attestations: write
  id-token: write

on:
  push:
    branches: [ "master" ]

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}
  REGISTRY_IMAGE: "ghcr.io/cottand/selfhosted"

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - uses: cachix/install-nix-action@v22
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}

      - uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Flake check
        run: |
          nix check .

  build-images:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - uses: cachix/install-nix-action@v22
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}

      - uses: DeterminateSystems/magic-nix-cache-action@main

      - name: Build images
        run: |
          nix build -L .#scripts.all-images

      - name: Install skopeo
        run: |
          nix profile install nixpkgs#skopeo

      - name: Login to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | skopeo login -u ${{ github.actor }} --password-stdin https://ghcr.io

      - name: Push all images
        shell: python
        run: |
          import os
          import json
          
          images = os.popen("jq < $(nix build .#scripts.all-images --print-out-paths)").read()
          git_sha = os.popen('git rev-parse --short "$GITHUB_SHA"').read().strip()
          
          for repo, path in json.loads(images).items():
            dest_repo = f'docker://ghcr.io/cottand/selfhosted/{repo}:{git_sha}'
            print(os.popen(f'skopeo --insecure-policy copy "docker-archive:{path}" "{dest_repo}"').read())