name: Image

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
    types: [ labeled, unlabeled, opened, synchronize, reopened ]

env:
  GOLANG_VERSION: '1.17'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  publish:
    permissions:
      contents: write  # for git to push upgrade commit if not already deployed
    if: github.repository == 'argoproj/argo-cd'
    runs-on: ubuntu-latest
    env:
      GOPATH: /home/runner/work/argo-cd/argo-cd
    steps:
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - uses: actions/checkout@master
        with:
          path: src/github.com/argoproj/argo-cd

      # get image tag
      - run: echo ::set-output name=tag::$(cat ./VERSION)-${GITHUB_SHA::8}
        working-directory: ./src/github.com/argoproj/argo-cd
        id: image

      # login
      - run: |
          docker login ghcr.io --username $USERNAME --password $PASSWORD
          docker login quay.io --username "${DOCKER_USERNAME}" --password "${DOCKER_TOKEN}"
        if: github.event_name == 'push'
        env:
          USERNAME: ${{ secrets.USERNAME }}
          PASSWORD: ${{ secrets.TOKEN }}
          DOCKER_USERNAME: ${{ secrets.RELEASE_QUAY_USERNAME }}
          DOCKER_TOKEN: ${{ secrets.RELEASE_QUAY_TOKEN }}

      # build
      - uses: docker/setup-qemu-action@v2
      - uses: docker/setup-buildx-action@v2
      - run: |
          IMAGE_PLATFORMS=linux/amd64
          if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-arm-image') }}" == "true" ]]
          then
            IMAGE_PLATFORMS=linux/amd64,linux/arm64
          fi
          echo "Building image for platforms: $IMAGE_PLATFORMS"
          docker buildx build --platform $IMAGE_PLATFORMS --push="${{ github.event_name == 'push' }}" \
            -t ghcr.io/argoproj/argocd:${{ steps.image.outputs.tag }} \
            -t quay.io/argoproj/argocd:latest .
        working-directory: ./src/github.com/argoproj/argo-cd


      # sign container images
      - name: Install cosign
        uses: sigstore/cosign-installer@main
        with:
          cosign-release: 'v1.13.0'

      - name: Sign Argo CD latest image
        run: |
          cosign sign --key env://COSIGN_PRIVATE_KEY quay.io/argoproj/argocd:latest
          # Displays the public key to share.
          cosign public-key --key env://COSIGN_PRIVATE_KEY
        env:
          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
        if: ${{ github.event_name == 'push' }}

      # deploy
      - run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"
        if: github.event_name == 'push'
        env:
          TOKEN: ${{ secrets.TOKEN }}
      - run: |
          docker run -u $(id -u):$(id -g) -v $(pwd):/src -w /src --rm -t ghcr.io/argoproj/argocd:${{ steps.image.outputs.tag }} kustomize edit set image quay.io/argoproj/argocd=ghcr.io/argoproj/argocd:${{ steps.image.outputs.tag }}
          git config --global user.email 'ci@argoproj.com'
          git config --global user.name 'CI'
          git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ steps.image.outputs.tag }}' && git push)
        if: github.event_name == 'push'
        working-directory: argoproj-deployments/argocd
      # TODO: clean up old images once github supports it: https://github.community/t5/How-to-use-Git-and-GitHub/Deleting-images-from-GitHub-Package-Registry/m-p/41202/thread-id/9811
