build.yml

name: Build Images & Assets

on:
  workflow_call:
  pull_request:

env:
  # github.sha doesn't always refer to the commit we're running on... which is fucking stupid
  # So we have to do this charade
  # https://github.com/orgs/community/discussions/25191
  SHA: ${{ github.event.pull_request.head.sha || github.sha }}

jobs:
  api-build:
    name: "API/Build"
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up docker buildx
        uses: docker/setup-buildx-action@v2

      - name: Docker login
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push image
        uses: docker/build-push-action@v3
        with:
          context: ./api/
          file: ./api/Dockerfile
          tags: ghcr.io/lucaspickering/beta-spray-api:${{ env.SHA }}
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: BUILD_PRODUCTION=true

      - name: Build Django static assets
        # Use dev settings here so we don't need to load secrets
        # It'd be nice to be able to use the built image ID from the previous
        # step's output, but that doesn't work because the image gets pushed
        # without being exported locally. Should be fixable after:
        # https://github.com/moby/buildkit/issues/1555
        run: >
          docker run
          -v $PWD/static:/app/src/static
          -e DJANGO_SETTINGS_MODULE=beta_spray.settings.settings_dev
          ghcr.io/lucaspickering/beta-spray-api:${{ env.SHA }} ./m.sh collectstatic

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: api-static-assets
          path: ./static/

  ui-build:
    name: "UI/Build"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Cache npm files
        uses: actions/cache@v3
        with:
          path: ui/node_modules
          key: ${{ runner.os }}-npm-${{ hashFiles('ui/package-lock.json') }}

      - name: Install dependencies
        working-directory: ui/
        run: npm install

      - name: Build
        working-directory: ui/
        run: NODE_ENV=production npm run build

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: ui-static-assets
          path: ./ui/build/

  general-upload:
    name: "General/Upload"
    runs-on: ubuntu-latest
    needs:
      - api-build
      - ui-build
    permissions:
      contents: read
      id-token: write
    steps:
      # Needed in order to pass auth creds to subsequent steps
      - name: Checkout
        uses: actions/checkout@v3

      - name: Google Cloud auth
        uses: google-github-actions/auth@v0
        with:
          service_account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
          workload_identity_provider: ${{ secrets.GOOGLE_WORKLOAD_ID_PROVIDER }}

      # Unpack both UI and API assets into the directory structure that we'll
      # want in the bucket, so we can upload them all at once

      - name: Download UI static assets
        uses: actions/download-artifact@v3
        with:
          name: ui-static-assets
          path: ./assets/

      - name: Download API static assets
        uses: actions/download-artifact@v3
        with:
          name: api-static-assets
          path: ./assets/api-static/

      - name: Upload static assets to GCS
        uses: google-github-actions/upload-cloud-storage@v0
        with:
          path: ./assets/
          parent: false # Don't include /assets/ in the bucket
          destination: beta-spray-static/${{ env.SHA }}/