name: MinIO image

# A separate publisher, never a dependency of ordinary CI. Image changes get
# a build/smoke test on PRs; only reviewed main commits can move :latest.
on:
  push:
    branches: [main]
    paths:
      - '.github/ci/minio/**'
      - '.github/workflows/minio-image.yml'
      - 'docker-compose.yml'
      - 'docker-compose.ci.yml'
  pull_request:
    paths:
      - '.github/ci/minio/**'
      - '.github/workflows/minio-image.yml'
      - 'docker-compose.yml'
      - 'docker-compose.ci.yml'
  workflow_dispatch:

concurrency:
  group: minio-image-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

env:
  IMAGE_NAME: ghcr.io/block/buzz-minio
  COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
  MINIO_CI_IMAGE: ghcr.io/block/buzz-minio:sha-${{ github.sha }}-run-${{ github.run_id }}-${{ github.run_attempt }}

jobs:
  image:
    name: Build and smoke-test MinIO
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Build image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .github/ci/minio
          platforms: linux/amd64
          load: true
          tags: ${{ env.MINIO_CI_IMAGE }}
          labels: org.opencontainers.image.revision=${{ github.sha }}
          # A maintenance dispatch must refresh apk packages even with a warm
          # layer cache. Normal image changes can still reuse cached layers.
          no-cache: ${{ github.event_name == 'workflow_dispatch' }}
          cache-from: type=gha,scope=minio
          cache-to: type=gha,scope=minio,mode=max
      - name: Smoke-test CI services
        run: bash .github/ci/minio/smoke-test.sh
      - name: Clean up smoke test
        if: always()
        run: docker compose down --volumes
      - name: Log in to GHCR
        if: github.repository == 'block/buzz' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish tested image
        if: github.repository == 'block/buzz' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        run: |
          docker push "$MINIO_CI_IMAGE"
          docker tag "$MINIO_CI_IMAGE" "$IMAGE_NAME:latest"
          docker push "$IMAGE_NAME:latest"
          {
            echo "Published $MINIO_CI_IMAGE and $IMAGE_NAME:latest"
            echo 'First publication: make the buzz-minio package public before enabling CI consumers.'
          } >> "$GITHUB_STEP_SUMMARY"