build-bake.yaml

on:
  schedule:
    - cron: '0 8 * * 1'  # Every Monday at 8:00 UTC for automatic rebuilds (pull in OS updates, security patches, etc.)
  push:
    branches:
      - main
      - dev
  pull_request:
  
name: Release - Build, Test, and Push
jobs:
  pre:
    name: Pre-Run Setup
    runs-on: ubuntu-latest-4x

    outputs:
      buildkit-builder: ${{ steps.setup-buildx.outputs.name }}

    concurrency:
      group: bake-pre-${{ github.ref }}
      cancel-in-progress: true

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        id: setup-buildx
        with:
          buildkitd-config: ./share/buildkitd.toml
          cleanup: false

  base:
    needs: [pre]
    name: Base Images
    runs-on: ubuntu-latest-4x

    concurrency:
      group: bake-base-${{ github.ref }}
      cancel-in-progress: true

    env:
      target: base-images

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build, Test, and Push
        uses: ./.github/actions/bake-test-push
        with:
          target: ${{ env.target }}
          builder: ${{ needs.pre.outputs.buildkit-builder }}
          push-image: ${{ github.ref == 'refs/heads/main' }}
          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
          dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
          dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'

  workbench:
    name: Workbench
    runs-on: ubuntu-latest-4x

    needs: [pre, base]

    concurrency:
      group: bake-workbench-${{ github.ref }}
      cancel-in-progress: true

    env:
      target: workbench

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build, Test, and Push
        uses: ./.github/actions/bake-test-push
        with:
          target: ${{ env.target }}
          builder: ${{ needs.pre.outputs.buildkit-builder }}
          push-image: ${{ github.ref == 'refs/heads/main' }}
          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
          dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
          dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'

  post:
    if: ${{ always() }}
    needs: [pre, base, workbench]

    name: Post-Run Cleanup
    runs-on: ubuntu-latest-4x

    concurrency:
      group: bake-post-${{ github.ref }}
      cancel-in-progress: true

    env:
      target: post-images

    steps:
      - name: Cleanup buildx builder
        run: |
          docker buildx stop ${{ needs.pre.outputs.buildkit-builder }}
          docker buildx prune ${{ needs.pre.outputs.buildkit-builder }}
          docker buildx rm ${{ needs.pre.outputs.buildkit-builder }}