build-pr.yml

name: Earthly PR +build

concurrency: 
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

on:
  pull_request:

env:
  FORCE_COLOR: 1

jobs:
  build:
    timeout-minutes: 60
    runs-on: ubuntu-latest

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@v6
        env:
          EARTHLY_SAT_TOKEN: ${{ secrets.EARTHLY_SAT_TOKEN }}
        if: env.EARTHLY_SAT_TOKEN == null

      - uses: earthly/actions-setup@v1
        with:
          version: v0.8.4

      - name: Earthly login
        env:
          EARTHLY_SAT_TOKEN: ${{ secrets.EARTHLY_SAT_TOKEN }}
        if: env.EARTHLY_SAT_TOKEN != null
        run: |
          earthly account login --token ${{ secrets.EARTHLY_SAT_TOKEN }} >> /dev/null
          earthly org s blue-build
          earthly sat s blue-build-pr

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.ref }}

      - name: Run build
        run: earthly --ci +build

  integration-tests:
    permissions:
      packages: write
    timeout-minutes: 60
    runs-on: ubuntu-latest
    needs:
      - build

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@v6

      - uses: earthly/actions-setup@v1
        with:
          version: v0.8.4

      - name: Earthly login
        env:
          EARTHLY_SAT_TOKEN: ${{ secrets.EARTHLY_SAT_TOKEN }}
        if: env.EARTHLY_SAT_TOKEN != null
        run: |
          earthly account login --token ${{ secrets.EARTHLY_SAT_TOKEN }} >> /dev/null
          earthly org s blue-build
          earthly sat s blue-build-integration-tests

      # Setup repo and add caching
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.ref }}

      - name: Run integration tests
        if: github.repository == 'blue-build/cli'
        run: earthly --ci -P ./integration-tests+all

  docker-build:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    needs:
      - build

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@v6

      - uses: sigstore/cosign-installer@v3.3.0
      - uses: earthly/actions-setup@v1
        with:
          version: v0.8.4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true

      - name: Earthly login
        env:
          EARTHLY_SAT_TOKEN: ${{ secrets.EARTHLY_SAT_TOKEN }}
        if: env.EARTHLY_SAT_TOKEN != null
        run: |
          earthly account login --token ${{ secrets.EARTHLY_SAT_TOKEN }} >> /dev/null
          earthly org s blue-build
          earthly sat s blue-build-integration-tests

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.ref }}

      - name: Install bluebuild
        run: |
          earthly -a +install/bluebuild --BUILD_TARGET=x86_64-unknown-linux-musl /usr/local/bin/bluebuild

      - name: Expose GitHub Runtime
        uses: crazy-max/ghaction-github-runtime@v3

      - name: Run Build
        env:
          GH_TOKEN: ${{ github.token }}
          GH_PR_EVENT_NUMBER: ${{ github.event.number }}
          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
          BB_BUILDKIT_CACHE_GHA: true
        run: |
          cd integration-tests/test-repo
          bluebuild template -vv | tee Containerfile
          grep -q 'ARG IMAGE_REGISTRY=ghcr.io/blue-build' Containerfile || exit 1
          if [ -n "$GH_TOKEN" ] && [ -n "$COSIGN_PRIVATE_KEY" ]; then
            bluebuild build --push -vv
          else
            bluebuild build -vv
          fi