images-branch.yml

name: Branch images
env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
on: # yamllint disable-line rule:truthy
  pull_request:
    branches:
      - main
    types:
      - synchronize
  pull_request_review:
    types:
      - submitted
  workflow_dispatch:
    inputs:
      pr:
        required: true
        type: number
        description: PR number

jobs:
  approval:
    # Skip when triggered by pull request events on PR's from forks because the GITHUB_TOKEN on
    # those PR's does not have write access, and thus cannot deploy to GHCR.
    # Running this workflow against PR's from forks requires manually triggering it via `workflow_dispatch`.
    if: ${{ !github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    outputs:
      decision: ${{ steps.decision.outputs.decision }}
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: recursive

      - name: Set PR
        run: echo "PR=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
        if: github.event_name != 'workflow_dispatch'

      - name: Set PR when manually triggered (intended for forks)
        run: echo "PR=${{ inputs.pr }}" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch'

      # Skips push-updater-images by setting an output
      - name: Check if pull request is approved
        id: decision
        run: |
          # For security, the `gh` call that retrieves the PR approval status *must* also retrieve the commit at the
          # tip of the PR to ensure that any subsequent unreviewed commits are not pulled into this action workflow.
          DECISION=$(gh pr view ${{ env.PR }} --json reviewDecision,state,commits --jq '"\(.reviewDecision):\(.state):\(.commits | last .oid)"')
          echo "decision=$DECISION" >> $GITHUB_OUTPUT

  push-updater-images:
    runs-on: ubuntu-latest
    needs: approval
    if: startsWith(needs.approval.outputs.decision, 'APPROVED:OPEN')
    strategy:
      fail-fast: false
      matrix:
        suite:
          - { name: bundler, ecosystem: bundler }
          - { name: cargo, ecosystem: cargo }
          - { name: composer, ecosystem: composer }
          - { name: docker, ecosystem: docker }
          - { name: docker_compose, ecosystem: docker-compose }
          - { name: dotnet_sdk, ecosystem: dotnet-sdk }
          - { name: elm, ecosystem: elm }
          - { name: git_submodules, ecosystem: gitsubmodule }
          - { name: github_actions, ecosystem: github-actions }
          - { name: go_modules, ecosystem: gomod }
          - { name: gradle, ecosystem: gradle }
          - { name: hex, ecosystem: mix }
          - { name: maven, ecosystem: maven }
          - { name: npm_and_yarn, ecosystem: npm }
          - { name: nuget, ecosystem: nuget }
          - { name: pub, ecosystem: pub }
          - { name: python, ecosystem: pip }
          - { name: swift, ecosystem: swift }
          - { name: devcontainers, ecosystem: devcontainers }
          - { name: terraform, ecosystem: terraform }
          - { name: bun, ecosystem: bun }
          - { name: uv, ecosystem: uv }
    permissions:
      contents: read
      id-token: write
      packages: write
    env:
      DEPENDABOT_UPDATER_VERSION: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: recursive

      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Prepare tag
        run: echo "DEPENDABOT_UPDATER_VERSION=${{ github.sha }}" >> $GITHUB_ENV
        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_review'

      - name: Prepare tag (forks)
        run: |
          gh pr checkout ${{ inputs.pr }}

          # Ensure the commit we've checked out matches our expected SHA from when we checked the PR's approval status above.
          # This is a security measure to prevent any unreviewed commits from getting pulled into this action workflow.
          # The format is "APPROVED:OPEN:<PR_COMMIT_SHA>", so compare the end of the string to the current commit.
          [[ ${{needs.approval.outputs.decision}} =~ $(git rev-parse HEAD)$ ]]

          git fetch origin main
          git merge origin/main --ff-only || exit 1
          git submodule update --init --recursive
          echo "DEPENDABOT_UPDATER_VERSION=$(git rev-parse HEAD)" >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch'

      - name: Log in to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Build ecosystem image
        run: script/build ${{ matrix.suite.name }}

      - name: Push branch image
        run: |
          docker tag "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}" "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION"
          docker push "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION"
          cosign sign --yes $(cosign triangulate --type=digest "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION")

      - name: Set summary
        run: |
          echo "updater uploaded with tag \`$DEPENDABOT_UPDATER_VERSION\`" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "ghcr.io/dependabot/dependabot-updater-${{ matrix.suite.ecosystem }}:$DEPENDABOT_UPDATER_VERSION" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY