ci.yml

name: CI

on:
  push:
    # Avoid duplicate builds on PRs.
    branches:
      - main
    tags:
      - v*
  pull_request:

permissions:
  contents: read

jobs:
  shellcheck:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run shellcheck
        run: find . -type f \( -name "*.sh" -o -path "*/bin/*" \) ! -name '*.jq' | xargs -t shellcheck
  build-stack:
    runs-on: ubuntu-22.04
    needs:
      - shellcheck
    env:
      STACK: heroku-${{ matrix.stack-version }}
      STACK_VERSION: "${{ matrix.stack-version }}"
      DOCKER_HUB_TOKEN: "${{ secrets.DOCKER_HUB_TOKEN }}"
      DOCKER_HUB_USERNAME: "${{ secrets.DOCKER_HUB_USERNAME }}"
      MANIFEST_APP_TOKEN: "${{ secrets.MANIFEST_APP_TOKEN }}"
      MANIFEST_APP_URL: "${{ secrets.MANIFEST_APP_URL }}"
    strategy:
      fail-fast: false
      matrix:
        stack-version: ["20", "22", "24"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Build images
        run: bin/build.sh $STACK_VERSION
      - name: Check that the generated files are in sync
        run: |-
          status="$(git status --porcelain)"
          if [[ -n "$status" ]]; then
            echo "Generated files differ from checked-in versions! Run bin/build.sh to regenerate them locally."
            echo -e "\nChanged files:\n${status}\n"
            git diff
            exit 1
          fi
      - name: Publish to image registries
        run: |-
          docker buildx create --use
          bin/publish-to-registries.sh
        if: success() && (github.ref_name == 'main' || github.ref_type == 'tag')
      - name: Unpublish temp tags from this run
        run: bin/unpublish-tags.sh
        if: always() && (github.ref_name == 'main' || github.ref_type == 'tag')
      - name: Convert docker image and for Git tags release to Heroku staging
        run: bin/convert-and-publish-to-heroku.sh