build-trigger.yml

name: 🍜 Build/publish urunc-deploy

on:
  push:
    branches: ["main"]
    paths:
      - 'deployment/urunc-deploy/Dockerfile'
      - 'deployment/urunc-deploy/scripts/install.sh'
      - 'cmd/**'
      - 'pkg/**'
      - 'internal/**'
      - 'Makefile'
      - 'VERSION'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  get-changed-files:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.check.outputs.version_changed }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check if VERSION file changed
        id: check
        run: |
          # Get commit range
          if [[ "${{ github.event_name }}" == "push" ]]; then
            base_ref="${{ github.event.before }}"
            head_ref="${{ github.sha }}"
          else
            base_ref="HEAD~1"
            head_ref="HEAD"
          fi

          git fetch origin $base_ref --depth=1 || true
          changed=$(git diff --name-only "$base_ref" "$head_ref" | grep -c '^VERSION$' || true)

          if [[ "$changed" -gt 0 ]]; then
            echo "VERSION file changed"
            echo "version_changed=true" >> $GITHUB_OUTPUT
          else
            echo "VERSION not changed"
            echo "version_changed=false" >> $GITHUB_OUTPUT
          fi

  build-dockerfiles-deploy:
    name: Build urunc-deploy container image
    needs: get-changed-files
    uses: ./.github/workflows/build-latest.yml
    secrets: inherit
    with:
      runner: '["base", "dind", "2204"]'
      runner-archs: '["amd64", "arm64"]'
      dockerfiles: 'deployment/urunc-deploy/Dockerfile'
      version-tag: ${{ needs.get-changed-files.outputs.version == 'true' }}