release-container-image.yml

name: release-container-image

on:
  workflow_dispatch:
    inputs:
      optic_version:
        required: true
        type: string
        description: >
          The Optic version to package in the image. This should match a published release tag from
          https://github.com/opticdev/optic/releases.
  workflow_call:
    inputs:
      optic_version:
        required: true
        type: string
        description: >
          The Optic version to package in the image. This should match a published release tag from
          https://github.com/opticdev/optic/releases.

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

env:
  SKIP_ANNOUNCE: 'false'
  SKIP_PUBLISH: 'false'

jobs:
  build-and-publish:
    runs-on: ubuntu-latest-16-core
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Install Task
        run: curl -sL https://taskfile.dev/install.sh | sudo bash -s -- -b /usr/local/bin/

      - name: Login to Docker Hub
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_PROD_CI_BASIC }}
          role-session-name: release-container-image-workflow
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Login to Amazon ECR Public
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
        with:
          registry-type: public

      - name: Build and publish
        run: task docker:build:release OPTIC_CLI_VERSION="${{ inputs.optic_version }}" -- --push

      - name: Announce success
        uses: slackapi/slack-github-action@v1.25.0
        if: success()
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.BUILD_BOT_SLACK_WEBHOOK_URL_RELEASES }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        with:
          payload: |
            {
              "text": "${{github.actor}}: ✅ container images `docker.io/useoptic/optic:${{inputs.optic_version}}`, `public.ecr.aws/optic/optic:${{inputs.optic_version}}` published!"
            }
      - name: Announce failure
        uses: slackapi/slack-github-action@v1.25.0
        if: failure()
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.BUILD_BOT_SLACK_WEBHOOK_URL_RELEASES }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
        with:
          payload: |
            {
              "text": "${{github.actor}}: 🚫 container images failed to publish."
            }