build.yaml

name: Build-Publish

on:
  push:
    # Trigger on version tags like v1.0.0
    tags:
      - 'v*'
    # Trigger on pushes to main (typically PR merges)
    branches:
      - main
  # Allow manual trigger
  workflow_dispatch:

permissions:
  contents: read
  packages: write

# Cancel superseded builds so rapid pushes don't queue duplicates.
# Never cancel tag builds — each tag is a distinct release artifact.
concurrency:
  group: build-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref_type != 'tag' }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        image_config:
          # A2A runner used by the k8s Job in
          # exgentic_a2a_runner/k8s/job.yaml.
          - name: exgentic-a2a-runner
            context: ./exgentic_a2a_runner
            dockerfile: ./exgentic_a2a_runner/Dockerfile

    steps:
      # 1. Checkout code
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      # 2. Set up QEMU for multi-arch builds
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4

      # 3. Set up Docker Buildx
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4

      # 4. Log in to GitHub Container Registry
      - name: Log in to ghcr.io
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # 5. Resolve the image tag:
      #   - on v* tag  → the tag name (e.g. v0.0.1)
      #   - otherwise  → <sanitized-branch>-<sha7>
      - name: Generate image tag
        id: tag
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
          else
            BRANCH="${{ github.ref_name }}"
            BRANCH="${BRANCH//\//-}"
            SHORT_SHA="$(echo "${{ github.sha }}" | cut -c1-7)"
            echo "tag=${BRANCH}-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
          fi

      # 6. Extract Docker metadata. Apply `latest` on v* tag pushes,
      # pushes to main, and manual dispatches.
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6
        with:
          images: ghcr.io/${{ github.repository }}/${{ matrix.image_config.name }}
          tags: |
            type=raw,value=${{ steps.tag.outputs.tag }}
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}

      # 7. Build and push image. Note: no build-args here — the runner
      # doesn't need any today, and specifying `build-args:` twice (as
      # cortex's build.yaml does) silently drops matrix-level args
      # because the second key wins.
      - name: Build and push ${{ matrix.image_config.name }}
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
        with:
          context: ${{ matrix.image_config.context }}
          file: ${{ matrix.image_config.dockerfile }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}