python.yml

name: Publish the images

on:
  push:
    branches:
      - main
    paths:
      - 'python/Dockerfile_*'

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY_IMAGE_PREFIX: "quay.io/giskard/"

jobs:
  build:
    name: Build ${{ matrix.version }} (${{ matrix.platform }})
    strategy:
      matrix:
        version: ["3.12", "3.13", "3.14"]
        platform: ['ubuntu-latest', 'runner-ubuntu24-arm64']
      fail-fast: false
    runs-on: ${{ matrix.platform }}
    permissions:
      contents: read # clone repo
      id-token: write # OIDC token for Quay registry auth
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        id: builder
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Read Python patch version
        id: ver
        run: |
          pv=$(grep '^ENV PYTHON_VERSION ' "./python/Dockerfile_${VERSION}" | awk '{print $3}')
          echo "python_patch=$pv" >> "$GITHUB_OUTPUT"
        env:
          VERSION: ${{ matrix.version }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: |
            ${{ env.REGISTRY_IMAGE_PREFIX }}python
          flavor: |
            latest=false
          tags: |
            type=raw,enable=true,value=${{ matrix.version }}-${{ matrix.platform }}
            type=raw,enable=true,value=${{ steps.ver.outputs.python_patch }}-${{ matrix.platform }}

      - name: Get Quay token via OIDC
        id: quay-token
        run: |
          OIDC_TOKEN=$(curl -sS \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=quay.io" | jq -r '.value')
          QUAY_TOKEN=$(curl -sS \
            --user "giskard+docker_images_ci:${OIDC_TOKEN}" \
            https://quay.io/oauth2/federation/robot/token | jq -r '.token')
          echo "::add-mask::${QUAY_TOKEN}"
          echo "token=${QUAY_TOKEN}" >> "$GITHUB_OUTPUT"

      - name: Login to Quay
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: quay.io
          username: giskard+docker_images_ci
          password: ${{ steps.quay-token.outputs.token }}

      - name: Push
        id: push
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
        with:
          context: ./python
          file: ./python/Dockerfile_${{ matrix.version }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          builder: ${{ steps.builder.outputs.name }}
          push: true

      - name: Export digest
        run: |
          mkdir -p "/tmp/digests/${VERSION}"
          touch "/tmp/digests/${VERSION}/${PUSH_DIGEST#sha256:}"
        env:
          VERSION: ${{ matrix.version }}
          PUSH_DIGEST: ${{ steps.push.outputs.digest }}

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: digests-${{ matrix.version }}-${{ matrix.platform }}
          path: /tmp/digests/${{ matrix.version }}/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Merge manifests (${{ matrix.version }})
    strategy:
      matrix:
        version: ["3.12", "3.13", "3.14"]
    runs-on: ubuntu-latest
    needs:
      - build
    permissions:
      contents: read # clone repo
      id-token: write # OIDC token for Quay registry auth
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: digests-${{ matrix.version }}-*
          merge-multiple: true
          path: /tmp/digests/${{ matrix.version }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Read Python patch version
        id: ver
        run: |
          pv=$(grep '^ENV PYTHON_VERSION ' "./python/Dockerfile_${VERSION}" | awk '{print $3}')
          echo "python_patch=$pv" >> "$GITHUB_OUTPUT"
        env:
          VERSION: ${{ matrix.version }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          tags: |
            type=raw,value=${{ matrix.version }}
            type=raw,value=${{ steps.ver.outputs.python_patch }}
          images: |
            ${{ env.REGISTRY_IMAGE_PREFIX }}python
          flavor: |
            latest=false

      - name: Get Quay token via OIDC
        id: quay-token
        run: |
          OIDC_TOKEN=$(curl -sS \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=quay.io" | jq -r '.value')
          QUAY_TOKEN=$(curl -sS \
            --user "giskard+docker_images_ci:${OIDC_TOKEN}" \
            https://quay.io/oauth2/federation/robot/token | jq -r '.token')
          echo "::add-mask::${QUAY_TOKEN}"
          echo "token=${QUAY_TOKEN}" >> "$GITHUB_OUTPUT"

      - name: Login to Quay
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
        with:
          registry: quay.io
          username: giskard+docker_images_ci
          password: ${{ steps.quay-token.outputs.token }}

      - name: Create manifest list and push
        working-directory: /tmp/digests/${{ matrix.version }}
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf "${REGISTRY_IMAGE_PREFIX}python@sha256:%s " *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect "${REGISTRY_IMAGE_PREFIX}python:${META_VERSION}"
        env:
          META_VERSION: ${{ steps.meta.outputs.version }}