build-push-c1-art.yml

name: Docker Build Main Push C1 Artifactory

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  build-and-push-dev-c1:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

      - name: Add DoD Certificate Bundle
        env:
          CERT_BUNDLE_SHA256: ${{ secrets.DOD_CA_CERT_BUNDLE_SHA256 }}
        run: |
          echo "$CERT_BUNDLE_SHA256" > scripts/dod_ca_cert_bundle.sha256
          sudo bash scripts/add-dod-cas.sh

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5
        with:
          # list of Docker images to use as base name for tags
          images: |
            ${{ secrets.C1_REGISTRY }}/${{ secrets.C1_REPOSITORY }}
          tags: |
            type=sha,prefix=,format=long
          flavor: |
            latest=false

      - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3
        id: buildx
        with:
          config-inline: |
            [registry."${{ secrets.C1_REGISTRY }}"]
              ca=["/etc/ssl/certs/adoptium/cacerts"]
              http = false
              insecure = true

      - name: Build
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
        with:
          context: .
          file: Dockerfile-gh
          push: false
          load: true
          tags: ${{ secrets.C1_REGISTRY}}/${{ secrets.C1_REPOSITORY }}:${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BUILD=${{ github.sha }}

      - name: Login to Dev Artifactory Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        with:
          registry: ${{ secrets.C1_REGISTRY }}
          username: ${{ secrets.C1_ART_USERNAME }}
          password: ${{ secrets.C1_ARTIFACTORY_TOKEN }}

      - name: Push image to C1 Dev, Test, and Prod Artifactory
        id: push-c1-image
        env:
          IMAGE_TAG: ${{ github.sha }}
          C1_REGISTRY: ${{ secrets.C1_REGISTRY }}
          C1_REPOSITORY: ${{ secrets.C1_REPOSITORY }}
          DEV_CERT: ${{ secrets.SAML_CERT }}
          TEST_CERT: ${{ secrets.C1_TEST_SAML_CERT }}
          PROD_CERT: ${{ secrets.C1_PROD_SAML_CERT }}
        run: |
          docker push $C1_REGISTRY/$C1_REPOSITORY:$IMAGE_TAG
          docker tag $C1_REGISTRY/$C1_REPOSITORY:$IMAGE_TAG $C1_REGISTRY/dockerreadyfortest/portal/client:$IMAGE_TAG
          docker push $C1_REGISTRY/dockerreadyfortest/portal/client:$IMAGE_TAG
          docker tag $C1_REGISTRY/$C1_REPOSITORY:$IMAGE_TAG $C1_REGISTRY/dockerreadyforprod/portal/client:$IMAGE_TAG
          docker push $C1_REGISTRY/dockerreadyforprod/portal/client:$IMAGE_TAG
          echo "image=$C1_REGISTRY/$C1_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT