build_push.yml

---
name: Build and Publish Image

env:
  REGISTRY: ghcr.io
  CRAN_PM: https://packagemanager.posit.co/cran/__linux__
  OS_NAME: ubuntu
  OS_VERSION: jammy

on:
  workflow_dispatch:
    inputs:
      r_version:
        description: R Version
        required: true
        type: choice
        default: "4.3.2"
        options:
          - "4.3.2"
          - "latest"
      quarto_version:
        description: Quarto version
        required: true
        type: choice
        default: "1.3.450"
        options:
          - "1.3.450"
          - "latest"
      pandoc_version:
        description: Pandoc version
        required: true
        type: choice
        default: "2.9.2.1"
        options:
          - "2.9.2.1"
          - "latest"
      cran_snapshot_date:
        description: CRAN packages snapshot date (YYYY-MM-DD)
        required: true
        default: "2024-01-12"
        type: string
      custom_tag:
        description: Custom image tag
        required: false
        default: ""
        type: string

jobs:
  build_publish:
    name: Build and Publish Image
    runs-on: ubuntu-latest

    permissions:
      packages: write

    steps:
      - name: Checkout project ⬇️
        uses: actions/checkout@v4

      - name: Checkout Rocker project ⬇️
        uses: actions/checkout@v4
        with:
          repository: rocker-org/rocker-versioned2
          path: ./rocker_scripts
          ref: master

      - name: Set up Docker Buildx 📐
        uses: docker/setup-buildx-action@v3
        with:
          install: true

      - name: Log in to the container registry 🗝️
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set build variables ✏️
        id: build_vars
        shell: bash
        run: |
          echo "IMAGE_DATE_TAG=$(date +%Y.%m.%d)" >> $GITHUB_OUTPUT
          CRAN_DATE=$(echo ${{ github.event.inputs.cran_snapshot_date }} | sed 's/-/\./g')
          IMAGE_NAME=${{ env.REGISTRY }}/${{ github.repository_owner }}/r_${{ github.event.inputs.r_version }}_cran_${CRAN_DATE}
          echo "IMAGE_NAME=${IMAGE_NAME,,}" >> $GITHUB_OUTPUT

      - name: Docker metadata 🐋
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ steps.build_vars.outputs.IMAGE_NAME }}
          tags: |
            ${{ steps.build_vars.outputs.IMAGE_DATE_TAG }}
            ${{ github.event.inputs.custom_tag }}
            type=raw,value=latest,enable=${{ github.ref_name == 'main' }}
          labels: |
            org.opencontainers.image.description=Image used in CI workflows by the Boehringer-Ingelheim organisation
            org.opencontainers.image.vendor=Boehringer-Ingelheim

      - name: Build and push image 🛠️
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          platforms: linux/amd64
          cache-from: type=registry,ref=${{ steps.build_vars.outputs.IMAGE_NAME }}:cache
          cache-to: type=registry,ref=${{ steps.build_vars.outputs.IMAGE_NAME }}:cache,mode=min
          build-args: |
            R_VERSION=${{ github.event.inputs.r_version }}
            CRAN=${{ env.CRAN_PM }}/${{ env.OS_VERSION }}/${{ github.event.inputs.cran_snapshot_date }}
            OS_NAME=${{ env.OS_NAME }}
            OS_VERSION=${{ env.OS_VERSION }}
            PANDOC_VERSION=${{ github.event.inputs.pandoc_version }}
            QUARTO_VERSION=${{ github.event.inputs.quarto_version }}

    outputs:
      IMAGE: ${{ steps.build_vars.outputs.IMAGE_NAME }}
      TAG: ${{ steps.build_vars.outputs.IMAGE_DATE_TAG }}

  create-release:
    if: github.ref_name == 'main'
    needs: build_publish

    name: Create release
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Generate release body 📜
        id: build-release
        shell: bash
        run: |
          echo "RELEASE_BODY=Check the artifacts in this release for more information about the published image." >> $GITHUB_OUTPUT
          echo "TAGGED_IMAGE=${{ needs.build_publish.outputs.IMAGE }}:${{ needs.build_publish.outputs.TAG }}" >> $GITHUB_OUTPUT
          echo "SBOM_OUTPUT_FILENAME=${{ github.workspace }}/sbom.json" >> $GITHUB_OUTPUT

      - name: Generate image manifest and R package list 🛞
        shell: bash
        run: |
          docker manifest inspect ${{ steps.build-release.outputs.TAGGED_IMAGE }} > ${{ github.workspace }}/manifest.json
          docker run -v ${PWD}:/app ${{ steps.build-release.outputs.TAGGED_IMAGE }} \
          R -q -e 'write.csv(installed.packages(), file="/app/package_list.csv")'

      # - name: Generate SBOM 📃
      #   uses: anchore/sbom-action@v0
      #   with:
      #     image: "${{ steps.build-release.outputs.TAGGED_IMAGE }}"
      #     output-file: "${{ steps.build-release.outputs.SBOM_OUTPUT_FILENAME }}"
      #     artifact-name: "sbom.spdx"

      # - name: Create release 🎁
      #   uses: softprops/action-gh-release@v1
      #   with:
      #     body_path: RELEASE_BODY.txt
      #     token: ${{ secrets.GITHUB_TOKEN }}
      #     generate_release_notes: no
      #     tag_name: ${{ needs.build_publish.outputs.tag }}

      - name: Upload artifact to release 🔼
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: "package_list.csv"
          asset_name: "package.list.${{ needs.build_publish.outputs.IMAGE }}.csv"
          tag: "${{ needs.build_publish.outputs.TAG }}"
          overwrite: true
          body: "${{ steps.build-release.outputs.SBOM_OUTPUT_FILENAME }}"