main.yml

name: Release

on:
  push:
    branches:
      - master
  schedule:
    - cron: "0 * * * *"
  workflow_dispatch:
    inputs:
      klipperSha:
        description: "Klipper commit SHA to build"
        required: false
        default: ""
        type: string
      moonrakerSha:
        description: "Moonraker commit SHA to build"
        required: false
        default: ""
        type: string
      forceBuild:
        description: "Force image build"
        required: false
        default: false
        type: boolean

env:
  KLIPPER_REPOSITORY: https://github.com/KalicoCrew/kalico
  MOONRAKER_REPOSITORY: https://github.com/Arksine/moonraker
  IS_DEFAULT_BRANCH: ${{ endsWith(github.ref, github.event.repository.default_branch) }}

jobs:
  setup:
    name: Setup
    runs-on: ubuntu-latest
    outputs:
      klipper_sha: ${{ steps.repo.outputs.klipper_sha }}
      moonraker_sha: ${{ steps.repo.outputs.moonraker_sha }}
      image_sha: ${{ steps.repo.outputs.image_sha }}
      is_latest: ${{ steps.repo.outputs.is_latest }}
      build_image: ${{ steps.check.outputs.build_image }}
    steps:
      - name: Get Klipper and Moonraker metadata
        id: repo
        run: |
          if [ -z "$KLIPPER_SHA" ]; then
            KLIPPER_SHA=$(git ls-remote $KLIPPER_REPOSITORY HEAD | awk '{print $1}')
          elif "$IS_LATEST"; then
            KLIPPER_HEAD_SHA=$(git ls-remote $KLIPPER_REPOSITORY HEAD | awk '{print $1}')

            [ "$KLIPPER_SHA" = "$KLIPPER_HEAD_SHA" ] || IS_LATEST=false
          fi

          if [ -z "$MOONRAKER_SHA" ]; then
            MOONRAKER_SHA=$(git ls-remote $MOONRAKER_REPOSITORY HEAD | awk '{print $1}')
          elif "$IS_LATEST"; then
            MOONRAKER_HEAD_SHA=$(git ls-remote $MOONRAKER_REPOSITORY HEAD | awk '{print $1}')

            [ "$MOONRAKER_SHA" = "$MOONRAKER_HEAD_SHA" ] || IS_LATEST=false
          fi

          IMAGE_SHA=$(echo $KLIPPER_SHA-$MOONRAKER_SHA | sha1sum | awk '{print $1}')

          echo "klipper_sha=${KLIPPER_SHA}" >> $GITHUB_OUTPUT
          echo "moonraker_sha=${MOONRAKER_SHA}" >> $GITHUB_OUTPUT
          echo "image_sha=${IMAGE_SHA}" >> $GITHUB_OUTPUT
          echo "is_latest=${IS_LATEST}" >> $GITHUB_OUTPUT
        env:
          IS_LATEST: ${{ endsWith(github.ref, github.event.repository.default_branch) }}
          KLIPPER_SHA: ${{ github.event.inputs.klipperSha }}
          MOONRAKER_SHA: ${{ github.event.inputs.moonrakerSha }}

      - name: Check if new Docker image should be built
        id: check
        run: |
          if ! "$BUILD_IMAGE"; then
            docker buildx imagetools inspect ghcr.io/${GITHUB_REPOSITORY}:sha-${IMAGE_SHA} > /dev/null || BUILD_IMAGE=true
          fi

          echo "build_image=${BUILD_IMAGE}" >> $GITHUB_OUTPUT
        env:
          BUILD_IMAGE: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.forceBuild == 'true') }}
          IMAGE_SHA: ${{ steps.repo.outputs.image_sha }}

  build:
    name: Build and deploy
    runs-on: ubuntu-latest
    needs: setup
    if: ${{ needs.setup.outputs.build_image == 'true' }}
    permissions:
      id-token: write
      packages: write
      contents: read
      attestations: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Prepare GitHub metadata
        id: github_meta
        run: |
          REPOSITORY_NAME=${GITHUB_REPOSITORY#*/}
          echo "repository_name=${REPOSITORY_NAME}" >> $GITHUB_OUTPUT

      - name: Prepare Docker image metadata
        id: docker_meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ secrets.DOCKERHUB_USERNAME }}/${{ steps.github_meta.outputs.repository_name }}
            ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=klipper-sha-${{ needs.setup.outputs.klipper_sha }}
            type=raw,value=moonraker-sha-${{ needs.setup.outputs.moonraker_sha }}
            type=raw,value=sha-${{ needs.setup.outputs.image_sha }}
            type=raw,value=latest,enable=${{ needs.setup.outputs.is_latest }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: docker_push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          build-args: |
            KLIPPER_REPOSITORY=${{ env.KLIPPER_REPOSITORY }}
            KLIPPER_SHA=${{ needs.setup.outputs.klipper_sha }}
            MOONRAKER_REPOSITORY=${{ env.MOONRAKER_REPOSITORY }}
            MOONRAKER_SHA=${{ needs.setup.outputs.moonraker_sha }}
          push: true
          sbom: true
          provenance: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}

      - name: Attest Docker Hub image
        uses: actions/attest-build-provenance@v3
        with:
          subject-name: index.docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ steps.github_meta.outputs.repository_name }}
          subject-digest: ${{ steps.docker_push.outputs.digest }}
          push-to-registry: true

      - name: Attest Container Registry image
        uses: actions/attest-build-provenance@v3
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.docker_push.outputs.digest }}
          push-to-registry: true