container.yml

# Commercial also use this container image for their E2E tests
# Commercial rely on a container image built from the main branch with the tag 'main'
on:
  workflow_call:
    inputs:
      production-image-digest:
        description: 'Digest of image pushed to AWS ECR to run on AWS ECS. Gets used by `cdk synth`.'
        required: true
        type: string
    outputs:
      container-image:
        description: 'The generated container image path'
        value: ${{ jobs.image.outputs.container-image }}

jobs:
  image:
    runs-on: ubuntu-latest

    permissions:
      packages: write

    outputs:
      container-image: ${{ steps.push.outputs.registry-path }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Set up Node environment
        uses: ./.github/actions/setup-node-env

      - name: Add commit hash for PRout
        working-directory: dotcom-rendering
        run: |
          echo 'export const GIT_COMMIT_HASH = "${{ github.sha }}";' > src/server/prout.ts

      - name: Generate production bundle
        env:
          IMAGE_DIGEST: ${{ inputs.production-image-digest }}
        run: make riffraff-bundle
        working-directory: dotcom-rendering

      - name: Build Container Image
        id: build_image
        uses: redhat-actions/buildah-build@v3
        with:
          image: dotcom-rendering
          # Commercial rely on a container image built from the main branch with the tag 'main'
          tags: ${{ github.sha }} ${{ github.ref == 'refs/heads/main' && 'main' || '' }}
          context: ./
          containerfiles: ./dotcom-rendering/Containerfile

      - name: Push Image To GHCR
        uses: redhat-actions/push-to-registry@v2.8
        id: push
        with:
          image: ${{ steps.build_image.outputs.image }}
          tags: ${{ steps.build_image.outputs.tags }}
          registry: ghcr.io/guardian
          username: ${{ github.actor }}
          password: ${{ github.token }}