build_and_publish.yml

# .github/workflows/build_and_publish.yml
name: Build and Publish Containers

on:
  workflow_dispatch:
  pull_request:
    branches: [main]
    paths-ignore:
      - '.devcontainer/**'
      - '.github/**'
      - '.vscode/**'
  push:
    branches: [main]
    paths-ignore:
      - '.devcontainer/**'
      - '.github/**'
      - '.vscode/**'
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        version_major: [16, 17, 18]
        version_minor: [0]
    permissions:
      id-token: write
      packages: write
      contents: read
      attestations: write
    steps:
      # Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch full history for versioning and labels

      # Set up QEMU for multi-platform builds
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      # Set up Docker Buildx for multi-platform builds
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true  # Ensures Buildx is set up

      # Get the current timestamp for build identification
      - name: Get Current Timestamp
        id: get_timestamp
        run: echo "build_timestamp=$(date +%s)" >> $GITHUB_OUTPUT

      # Log in to the GitHub Container Registry
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Set up build variables and determine tags
      - name: Set up Build Variables
        id: vars
        shell: bash
        run: |
          set -e
          echo "Setting up build variables..."
          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          COMMIT_SHA="${{ github.sha }}"
          REPO_URL="${{ github.repositoryUrl }}"
          echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_ENV
          echo "COMMIT_SHA=${COMMIT_SHA}" >> $GITHUB_ENV
          echo "REPO_URL=${REPO_URL}" >> $GITHUB_ENV

          ODOO_VERSION="${{ matrix.version_major }}.${{ matrix.version_minor }}"
          ODOO_VERSION_PATTERN='^[0-9]+\.[0-9]+'

          echo "Determining version and tags..."
          TAG_LIST=()

          if [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
            echo "Event is a release"
            RELEASE_VERSION="${{ github.event.release.tag_name }}"
            # Extract semver components from RELEASE_VERSION
            IFS='.' read -ra VER_COMPONENTS <<< "$RELEASE_VERSION"
            REL_MAJOR="${VER_COMPONENTS[0]}"
            REL_MINOR="${VER_COMPONENTS[1]}"
            REL_PATCH="${VER_COMPONENTS[2]}"

            # Build tag list
            TAG_LIST+=("${ODOO_VERSION}")

            if [[ -n "${REL_MAJOR}" ]]; then
              TAG_LIST+=("${ODOO_VERSION}-${REL_MAJOR}")
            fi
            if [[ -n "${REL_MAJOR}" && -n "${REL_MINOR}" ]]; then
              TAG_LIST+=("${ODOO_VERSION}-${REL_MAJOR}.${REL_MINOR}")
            fi
            if [[ -n "${REL_MAJOR}" && -n "${REL_MINOR}" && -n "${REL_PATCH}" ]]; then
              TAG_LIST+=("${ODOO_VERSION}-${REL_MAJOR}.${REL_MINOR}.${REL_PATCH}")
            fi

            # For latest Odoo version, add "latest" tag
            if [[ "${ODOO_VERSION}" == "18.0" ]]; then
              TAG_LIST+=("latest")
            fi

            VERSION="${REL_MAJOR}.${REL_MINOR}.${REL_PATCH}"

          elif [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
            echo "On main branch"
            VERSION="edge"
            TAG_LIST+=("${ODOO_VERSION}-edge")

          elif [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
            PR_BRANCH="${GITHUB_HEAD_REF}"
            echo "Pull request from branch ${PR_BRANCH}"
            # Handle branch names that start with ODOO_VERSION
            if [[ "${PR_BRANCH}" =~ ^(${ODOO_VERSION_PATTERN})-(.+)$ ]]; then
              BRANCH_ODOO_VERSION="${BASH_REMATCH[1]}"
              BRANCH_SUFFIX="${BASH_REMATCH[2]}"
              if [[ "${BRANCH_ODOO_VERSION}" == "${ODOO_VERSION}" ]]; then
                VERSION="${BRANCH_SUFFIX}"
                TAG_LIST+=("${ODOO_VERSION}-${VERSION}")
              else
                VERSION="${PR_BRANCH}"
                TAG_LIST+=("${VERSION}")
              fi
            else
              VERSION="${PR_BRANCH}"
              TAG_LIST+=("${ODOO_VERSION}-${VERSION}")
            fi

          elif [[ "${GITHUB_REF_TYPE}" == "branch" ]]; then
            BRANCH_NAME="${GITHUB_REF#refs/heads/}"
            echo "On branch ${BRANCH_NAME}"
            # Handle branch names that start with ODOO_VERSION
            if [[ "${BRANCH_NAME}" =~ ^(${ODOO_VERSION_PATTERN})-(.+)$ ]]; then
              BRANCH_ODOO_VERSION="${BASH_REMATCH[1]}"
              BRANCH_SUFFIX="${BASH_REMATCH[2]}"
              if [[ "${BRANCH_ODOO_VERSION}" == "${ODOO_VERSION}" ]]; then
                VERSION="${BRANCH_SUFFIX}"
                TAG_LIST+=("${ODOO_VERSION}-${VERSION}")
              else
                VERSION="${BRANCH_NAME}"
                TAG_LIST+=("${VERSION}")
              fi
            else
              VERSION="${BRANCH_NAME}"
              TAG_LIST+=("${ODOO_VERSION}-${VERSION}")
            fi

          else
            echo "Event not matched, defaulting to 'dev'"
            VERSION="dev"
            TAG_LIST+=("${ODOO_VERSION}-dev")
          fi

          echo "VERSION=${VERSION}" >> $GITHUB_ENV

          # Remove duplicates from TAG_LIST
          TAG_LIST=($(printf "%s\n" "${TAG_LIST[@]}" | sort -u))

          ODOO_IMAGE_NAME="ghcr.io/${{ github.repository_owner }}/odoo-base"
          NGINX_IMAGE_NAME="ghcr.io/${{ github.repository_owner }}/odoo-nginx-base"

          echo "ODOO_IMAGE_NAME=${ODOO_IMAGE_NAME}" >> $GITHUB_ENV
          echo "NGINX_IMAGE_NAME=${NGINX_IMAGE_NAME}" >> $GITHUB_ENV

          # Generate tag lists for community and enterprise images
          ODOO_COMMUNITY_IMAGE_TAGS=""
          ODOO_ENTERPRISE_IMAGE_TAGS=""
          NGINX_COMMUNITY_IMAGE_TAGS=""
          NGINX_ENTERPRISE_IMAGE_TAGS=""

          for TAG in "${TAG_LIST[@]}"; do
            ODOO_COMMUNITY_IMAGE_TAGS+="${ODOO_IMAGE_NAME}:${TAG}\n"
            ENTERPRISE_TAG=$(echo "$TAG" | sed "s#^${ODOO_VERSION}#${ODOO_VERSION}e#")
            ODOO_ENTERPRISE_IMAGE_TAGS+="${ODOO_IMAGE_NAME}:${ENTERPRISE_TAG}\n"

            NGINX_COMMUNITY_IMAGE_TAGS+="${NGINX_IMAGE_NAME}:${TAG}\n"
            NGINX_ENTERPRISE_IMAGE_TAGS+="${NGINX_IMAGE_NAME}:${ENTERPRISE_TAG}\n"
          done

          echo "ODOO_COMMUNITY_IMAGE_TAGS<<EOF" >> $GITHUB_OUTPUT
          echo -e "${ODOO_COMMUNITY_IMAGE_TAGS}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "ODOO_ENTERPRISE_IMAGE_TAGS<<EOF" >> $GITHUB_OUTPUT
          echo -e "${ODOO_ENTERPRISE_IMAGE_TAGS}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "NGINX_COMMUNITY_IMAGE_TAGS<<EOF" >> $GITHUB_OUTPUT
          echo -e "${NGINX_COMMUNITY_IMAGE_TAGS}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "NGINX_ENTERPRISE_IMAGE_TAGS<<EOF" >> $GITHUB_OUTPUT
          echo -e "${NGINX_ENTERPRISE_IMAGE_TAGS}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          # Adjust SOURCE_IMAGE variables to match the correct tags
          SOURCE_TAG="${TAG_LIST[0]}"
          SOURCE_IMAGE_ODOO="${ODOO_IMAGE_NAME}:${SOURCE_TAG}"
          SOURCE_IMAGE_NGINX="${NGINX_IMAGE_NAME}:${SOURCE_TAG}"
          echo "SOURCE_IMAGE_ODOO=${SOURCE_IMAGE_ODOO}" >> $GITHUB_ENV
          echo "SOURCE_IMAGE_NGINX=${SOURCE_IMAGE_NGINX}" >> $GITHUB_ENV

      # Cache Python dependencies to speed up builds
      - name: Cache Python dependencies
        uses: actions/cache@v4
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      # Install Python dependencies
      - name: Install Python dependencies
        run: |
          pip install -r requirements.txt

      # Run Python unit tests
      - name: Run Python tests
        shell: bash
        continue-on-error: ${{ github.event_name != 'release' && github.ref != 'refs/heads/main' }}
        run: |
          echo "Running tests..."
          if [[ "${GITHUB_REF}" == "refs/heads/main" ]] || [[ "${GITHUB_EVENT_NAME}" == "release" ]]; then
            echo "Strict mode for tests; failing on test failures."
            set -e
            python3 -m unittest discover tests
          else
            echo "Non-strict mode for tests; not failing on test failures."
            set +e
            python3 -m unittest discover tests
          fi

      # Run builder preparation script
      - name: Run builder prep script
        env:
          ODOO_MAJOR_VERSION: ${{ matrix.version_major }}
          ODOO_MINOR_VERSION: ${{ matrix.version_minor }}
          ODOO_COMMUNITY_REPOSITORY: "github.com/odoo/odoo"
          ODOO_ENTERPRISE_REPOSITORY: "github.com/odoo/enterprise"
          GITHUB_TOKEN: ${{ secrets.APERIM_GITHUB_CI_PAT }}
          GEOIPUPDATE_ACCOUNT_ID: ${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
          GEOIPUPDATE_LICENSE_KEY: ${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
        run: python3 builder/src/main.py

      # Build and Push Community Odoo Container
      - name: Build and Push Community Odoo Container
        id: odoo_community_push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.c.odoo
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ steps.vars.outputs.ODOO_COMMUNITY_IMAGE_TAGS }}
          build-args: |
            ODOO_MAJOR_VERSION=${{ matrix.version_major }}
            ODOO_MINOR_VERSION=${{ matrix.version_minor }}
            BUILD_DATE=${{ env.BUILD_DATE }}
            VCS_REF=${{ env.COMMIT_SHA }}
            VERSION=${{ env.VERSION }}
            REPO_URL=${{ env.REPO_URL }}
            BUILD_TIMESTAMP=${{ steps.get_timestamp.outputs.build_timestamp }}
          labels: |
            org.opencontainers.image.created=${{ env.BUILD_DATE }}
            org.opencontainers.image.url=${{ env.REPO_URL }}
            org.opencontainers.image.source=${{ env.REPO_URL }}
            org.opencontainers.image.version=${{ env.VERSION }}
            org.opencontainers.image.revision=${{ env.COMMIT_SHA }}
            org.opencontainers.image.vendor="${{ github.repository_owner }}"
            org.opencontainers.image.title="Odoo ${{ matrix.version_major }}.${{ matrix.version_minor }}"
            org.opencontainers.image.description="Odoo ${{ matrix.version_major }}.${{ matrix.version_minor }} Community Container"
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Attest Community Odoo Container build provenance
      - name: Attest Odoo Container
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.ODOO_IMAGE_NAME }}
          subject-digest: ${{ steps.odoo_community_push.outputs.digest }}
          push-to-registry: true

      # Build and Push Community Nginx Container
      - name: Build and Push Community Nginx Container
        id: odoo_community_nginx_push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.c.nginx
          platforms: linux/amd64,linux/arm64,linux/ppc64le
          push: true
          tags: |
            ${{ steps.vars.outputs.NGINX_COMMUNITY_IMAGE_TAGS }}
          build-args: |
            ODOO_MAJOR_VERSION=${{ matrix.version_major }}
            ODOO_MINOR_VERSION=${{ matrix.version_minor }}
            BUILD_DATE=${{ env.BUILD_DATE }}
            VCS_REF=${{ env.COMMIT_SHA }}
            VERSION=${{ env.VERSION }}
            REPO_URL=${{ env.REPO_URL }}
          labels: |
            org.opencontainers.image.created=${{ env.BUILD_DATE }}
            org.opencontainers.image.url=${{ env.REPO_URL }}
            org.opencontainers.image.source=${{ env.REPO_URL }}
            org.opencontainers.image.version=${{ env.VERSION }}
            org.opencontainers.image.revision=${{ env.COMMIT_SHA }}
            org.opencontainers.image.vendor="${{ github.repository_owner }}"
            org.opencontainers.image.title="Odoo Nginx ${{ matrix.version_major }}.${{ matrix.version_minor }}"
            org.opencontainers.image.description="Nginx Container for Odoo ${{ matrix.version_major }}.${{ matrix.version_minor }} Community"
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Attest Community Nginx Container build provenance
      - name: Attest Nginx Container
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.NGINX_IMAGE_NAME }}
          subject-digest: ${{ steps.odoo_community_nginx_push.outputs.digest }}
          push-to-registry: true

      # Build and Push Enterprise Odoo Container
      - name: Build and Push Enterprise Odoo Container
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.e.odoo
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ steps.vars.outputs.ODOO_ENTERPRISE_IMAGE_TAGS }}
          build-args: |
            SOURCE_IMAGE=${{ env.SOURCE_IMAGE_ODOO }}
            BUILD_DATE=${{ env.BUILD_DATE }}
            VCS_REF=${{ env.COMMIT_SHA }}
            VERSION=${{ env.VERSION }}
            REPO_URL=${{ env.REPO_URL }}
            BUILD_TIMESTAMP=${{ steps.get_timestamp.outputs.build_timestamp }}
          labels: |
            org.opencontainers.image.created=${{ env.BUILD_DATE }}
            org.opencontainers.image.url=${{ env.REPO_URL }}
            org.opencontainers.image.source=${{ env.REPO_URL }}
            org.opencontainers.image.version=${{ env.VERSION }}
            org.opencontainers.image.revision=${{ env.COMMIT_SHA }}
            org.opencontainers.image.vendor="${{ github.repository_owner }}"
            org.opencontainers.image.title="Odoo ${{ matrix.version_major }}.${{ matrix.version_minor }}e"
            org.opencontainers.image.description="Odoo ${{ matrix.version_major }}.${{ matrix.version_minor }} Enterprise Container"
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Build and Push Enterprise Nginx Container
      - name: Build and Push Enterprise Nginx Container
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.e.nginx
          platforms: linux/amd64,linux/arm64,linux/ppc64le
          push: true
          tags: |
            ${{ steps.vars.outputs.NGINX_ENTERPRISE_IMAGE_TAGS }}
          build-args: |
            SOURCE_IMAGE=${{ env.SOURCE_IMAGE_NGINX }}
            BUILD_DATE=${{ env.BUILD_DATE }}
            VCS_REF=${{ env.COMMIT_SHA }}
            VERSION=${{ env.VERSION }}
            REPO_URL=${{ env.REPO_URL }}
          labels: |
            org.opencontainers.image.created=${{ env.BUILD_DATE }}
            org.opencontainers.image.url=${{ env.REPO_URL }}
            org.opencontainers.image.source=${{ env.REPO_URL }}
            org.opencontainers.image.version=${{ env.VERSION }}
            org.opencontainers.image.revision=${{ env.COMMIT_SHA }}
            org.opencontainers.image.vendor="${{ github.repository_owner }}"
            org.opencontainers.image.title="Odoo Nginx ${{ matrix.version_major }}.${{ matrix.version_minor }}e"
            org.opencontainers.image.description="Nginx Container for Odoo ${{ matrix.version_major }}.${{ matrix.version_minor }} Enterprise"
          cache-from: type=gha
          cache-to: type=gha,mode=max

  notify-repos:
    needs: build-and-publish
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'release' && needs.build-and-publish.result == 'success' }}
    steps:
      - name: Send repository_dispatch events to list of repos
        env:
          REPOSITORIES_TO_PING: ${{ secrets.REPOSITORIES_TO_PING }}
          PAT_FOR_PINGING: ${{ secrets.APERIM_GITHUB_CI_PAT }}
          CURRENT_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          if [ -z "${REPOSITORIES_TO_PING}" ]; then
            echo "No repositories to ping."
            exit 0
          fi
          echo "Repositories to ping: ${REPOSITORIES_TO_PING}"
          # Replace commas and/or spaces with newlines, then loop over lines
          echo "${REPOSITORIES_TO_PING}" | tr ',\n' ' ' | tr ' ' '\n' | while read -r REPO; do
            REPO=$(echo "$REPO" | xargs) # Trim whitespace
            if [ ! -z "$REPO" ]; then
              echo "Pinging repository: $REPO"
              # Prepare the payload
              PAYLOAD="{\"event_type\": \"update_base_image\", \"client_payload\": { \"repository\": \"${CURRENT_REPO}\", \"release_tag\": \"${RELEASE_TAG}\" }}"
              # Send repository_dispatch event
              curl -X POST \
                -H "Authorization: token ${PAT_FOR_PINGING}" \
                -H "Accept: application/vnd.github+json" \
                https://api.github.com/repos/${REPO}/dispatches \
                -d "${PAYLOAD}"
            fi
          done