rabbitmq-oci.yaml

# https://github.com/marketplace/actions/build-and-push-docker-images
name: RabbitMQ OCI
on:
  pull_request:
  workflow_dispatch:
    inputs:
      rabbitmq_ref:
        description: The branch, tag or commit of rabbitmq-server to use
        default: main
env:
  GENERIC_UNIX_ARCHIVE: ${{ github.workspace }}/rabbitmq-server/bazel-bin/package-generic-unix.tar.xz
jobs:

  build-publish-dev:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - image_tag_suffix: otp-max
            otp_major: 25
    steps:
      - name: Checkout Osiris
        uses: actions/checkout@v3
        with:
          path: osiris

      - name: Inject the git sha as the osiris version
        working-directory: osiris
        run: |
          sed -i"_orig" -E '/VERSION/ s/module_version\(\)/"${{ github.event.pull_request.head.sha || github.sha }}"/' BUILD.bazel
          git diff

      - name: Checkout RabbitMQ
        uses: actions/checkout@v3
        with:
          repository: rabbitmq/rabbitmq-server
          ref: ${{ github.event.inputs.rabbitmq_ref }}
          path: rabbitmq-server

      - name: Mount Bazel Cache
        uses: actions/cache@v1
        with:
          path: "/home/runner/repo-cache/"
          key: repo-cache

      - name: Configure Bazel
        working-directory: rabbitmq-server
        run: |
          if [ -n "${{ secrets.BUILDBUDDY_API_KEY }}" ]; then
          cat << EOF >> user.bazelrc
            build:buildbuddy --remote_header=x-buildbuddy-api-key=${{ secrets.BUILDBUDDY_API_KEY }}
          EOF
          fi
          cat << EOF >> user.bazelrc
            build:buildbuddy --build_metadata=ROLE=CI
            build:buildbuddy --build_metadata=VISIBILITY=PRIVATE
            build:buildbuddy --repository_cache=/home/runner/repo-cache/
            build:buildbuddy --color=yes
            build:buildbuddy --disk_cache=

            build:buildbuddy --remote_download_toplevel
          EOF

      - name: Load OTP Version Info
        working-directory: rabbitmq-server
        id: load-info
        run: |
          bazelisk build :otp_version --config=rbe-${{ matrix.otp_major }}
          echo "::set-output name=otp::$(cat bazel-bin/otp_version.txt)"

      - name: Load RabbitMQ Version Info
        id: load-rabbitmq-info
        working-directory: rabbitmq-server
        run: |
          echo "::set-output name=RABBITMQ_SHA::$(git rev-parse HEAD)"
          echo "::set-output name=RABBITMQ_REF::$(git rev-parse --abbrev-ref HEAD)"

      - name: Build generic unix package with this osiris
        working-directory: rabbitmq-server
        run: |
          sed -i"_orig" -E '/APP_VERSION/ s/3\.[0-9]+\.[0-9]+/${{ steps.load-rabbitmq-info.outputs.RABBITMQ_SHA }}/' rabbitmq.bzl
          bazelisk build :package-generic-unix \
            --config=rbe-${{ matrix.otp_major }} \
            --override_module rabbitmq_osiris=${{ github.workspace }}/osiris

          # check that override did indeed work
          set -o pipefail
          if ! tar --list -f ./bazel-bin/package-generic-unix.tar.xz  | grep -F "plugins/osiris-${{ github.event.pull_request.head.sha || github.sha }}/ebin/osiris.app" ; then
            echo "Failed to override osiris repo"
            ls bazel-bin/external/ | grep osiris
            exit 1
          fi

      - name: Resolve generic unix package path
        run: |
          echo "::set-output name=ARTIFACT_PATH::$(readlink -f ${GENERIC_UNIX_ARCHIVE})"
        id: resolve-artifact-path

      - name: Save the package as a workflow artifact
        uses: actions/upload-artifact@v3
        with:
          name: rabbitmq-package-generic-unix-${{ steps.load-info.outputs.otp }}.tar.xz
          path: ${{ steps.resolve-artifact-path.outputs.ARTIFACT_PATH }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Cache Docker layers
        uses: actions/cache@v3
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-${{ matrix.image_tag_suffix }}-buildx-${{ github.event.pull_request.head.sha || github.sha }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.image_tag_suffix }}-buildx-

      - name: Check for Push Credentials
        id: authorized
        run: |
          if [ -n "${{ secrets.DOCKERHUB_USERNAME }}" ]; then
            echo "::set-output name=PUSH::true"
          else
            echo "::set-output name=PUSH::false"
          fi

      - name: Login to DockerHub
        if: steps.authorized.outputs.PUSH == 'true'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Expand generic-unix-package
        working-directory: rabbitmq-server/packaging/docker-image
        run: |
          xzcat ${GENERIC_UNIX_ARCHIVE} | tar xvf -

      - name: Compute Image Tags
        id: compute-tags
        run: |
          RABBIT_REF=${{ steps.load-rabbitmq-info.outputs.RABBITMQ_REF }}
          RABBIT_SHA=${{ steps.load-rabbitmq-info.outputs.RABBITMQ_SHA }}

          OSIRIS_SHA=${{ github.event.pull_request.head.sha || github.sha }}
          OSIRIS_ABBREV=osiris-${OSIRIS_SHA:0:7}

          TAG_1=rabbitmq-${RABBIT_REF}-${OSIRIS_ABBREV}-${{ steps.load-info.outputs.otp }}
          TAG_2=rabbitmq-${RABBIT_REF}-${OSIRIS_ABBREV}-${{ matrix.image_tag_suffix }}
          TAG_3=rabbitmq-${RABBIT_SHA:0:7}-${OSIRIS_ABBREV}-${{ steps.load-info.outputs.otp }}
          TAG_4=rabbitmq-${RABBIT_SHA:0:7}-${OSIRIS_ABBREV}-${{ matrix.image_tag_suffix }}

          echo "Will tag with ${TAG_1}"
          echo "Will tag with ${TAG_2}"
          echo "Will tag with ${TAG_3}"
          echo "Will tag with ${TAG_4}"

          echo "::set-output name=TAG_1::${TAG_1}"
          echo "::set-output name=TAG_2::${TAG_2}"
          echo "::set-output name=TAG_3::${TAG_3}"
          echo "::set-output name=TAG_4::${TAG_4}"

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: rabbitmq-server/packaging/docker-image
          pull: true
          push: ${{ steps.authorized.outputs.PUSH }}
          tags: |
            pivotalrabbitmq/rabbitmq:${{ steps.compute-tags.outputs.TAG_1 }}
            pivotalrabbitmq/rabbitmq:${{ steps.compute-tags.outputs.TAG_2 }}
            pivotalrabbitmq/rabbitmq:${{ steps.compute-tags.outputs.TAG_3 }}
            pivotalrabbitmq/rabbitmq:${{ steps.compute-tags.outputs.TAG_4 }}
          build-args: |
            SKIP_PGP_VERIFY=true
            PGP_KEYSERVER=pgpkeys.eu
            OTP_VERSION=${{ steps.load-info.outputs.otp }}
            SKIP_OTP_VERIFY=true
            RABBITMQ_BUILD=rabbitmq_server-${{ steps.load-rabbitmq-info.outputs.RABBITMQ_SHA }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new

      # Temp fix
      # https://github.com/docker/build-push-action/issues/252
      # https://github.com/moby/buildkit/issues/1896
      - name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache