release.yml

name: Create and publish the Docker image

on:
  push:
    branches:
      - "main"
    tags: ["*"]
    paths:
      - ".github/workflows/release.yml"
      - "container/**"
      - "Dockerfile"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push-image:
    runs-on: larger

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Set Up env (main)
        if: github.ref_type == 'tag'
        run: |
          echo "NETWORK=main" >> $GITHUB_ENV
          printf ${{ secrets.PRODUCTION_BASE64_JWT_PUBLIC_KEY }} | base64 --decode > ./container/nginx/jwt_pub.key

      - name: Set Up env (test)
        if: github.ref_type == 'branch'
        run: |
          echo "NETWORK=test" >> $GITHUB_ENV
          printf ${{ secrets.STAGING_BASE64_JWT_PUBLIC_KEY }} | base64 --decode > ./container/nginx/jwt_pub.key

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: "arm64"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Set the git short sha
        id: git
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Compute version hash
        id: secret
        run: |
          digest=$(echo -n "${{ github.run_number }}_${{ steps.git.outputs.sha_short }}${{ secrets.RELEASE_KEY }}" | sha256sum | head -c 64)
          echo "::add-mask::${digest}"
          echo "VERSION_HASH=${digest}" >> $GITHUB_ENV

      - name: Compute docker tags
        id: tags
        run: |
          repo="$REGISTRY/${IMAGE_NAME,,}"
          docker_tag="$NETWORK"

          # ensure canaries gets docker tagged correctly
          # and get moved forward whenever there's a main release
          echo "mutable_docker_tags<<EOF" >> $GITHUB_OUTPUT
          if [[ "$GITHUB_REF_TYPE" == "tag" ]] && [[ "$GITHUB_REF_NAME" == canary-* ]]; then
            docker_tag="canary"
          elif [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
            echo "${repo}:canary" >> $GITHUB_OUTPUT
          fi
          echo "${repo}:${docker_tag}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "version_docker_tags=$repo:${{ github.run_number}}_${{ steps.git.outputs.sha_short }}"

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ steps.tags.outputs.version_docker_tags }}
            ${{ steps.tags.outputs.mutable_docker_tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            NETWORK=${{ env.NETWORK }}
            VERSION=${{ github.run_number }}_${{ steps.git.outputs.sha_short }}
            VERSION_HASH=${{ env.VERSION_HASH }}
            SENTRY_DSN=${{ secrets.SENTRY_DSN }}
            LASSIE_EXCLUDE_PROVIDERS=bafzbeibhqavlasjc7dvbiopygwncnrtvjd2xmryk5laib7zyjor6kf3avm,12D3KooW9tKveruEsVduQotTn4y1JveEHG3oFtGLWfuQqVoG1LLT,12D3KooWT3dCAgHpMCSscSw4EKzNqcSjutEeB7TVqfedsK29CjfR,12D3KooWKBRcG1YF58DdbEkcmXi2gEPJL3hCD83Jz1VVYhB9Dajc,12D3KooWMui2xmPnUESnPgYF8iqjCnwuZiJC27ffQsbB2LLmSwip,12D3KooWEQu9bN4G6jCGUPehELV9uMKFsfx8pYtgyGnYCQE2j6er,12D3KooWMkBZYybPgHMr7Se5P2qecu4oz34V1TMgsLPJbNeBCekz,12D3KooWGW4U4iN6tcvFKcQD3Ay2i6LDdEAEJgZgdHUNasGGq8bb,12D3KooWNpqZzgepBsdeVQ4AfnNM2SeBVr5Mp2GcW1v5o3eghPTv,12D3KooWB9veWuW6rJ5YeTSYt5NSdTtJj6KzzriWwWPLv9SNnvph,12D3KooWFWZ7sZfgJH5FVNsN16p9JtN5MGJim5SejL6XweAM9Gv9,12D3KooWA9KoQ8NP6AtENpzzGUpCXLWnMQhJ5wjoyKKwVhUu6MtL,12D3KooWConjatXecCbhiRCnQYr5zFrJx87mamCCT5UFL7aZksG6,12D3KooWFH8QrpQNXMbGu7X6Tfa9m8WU7gZCgRspa43YzekkhmMv,12D3KooWPU4qxSwahNDLM4hBL2SCYE53g2XxyePQWWUBvgBZ8cJy,12D3KooWPJTPLqpnY1vbxg73BWqbs15YSoCvQogmfshM2zNB9AuD,12D3KooWCkLbm3Z4TUJGXZLqKiH3kRBJLpm7mdyYwZrrVDcQXBfH,12D3KooWH6WVTtcwN9eKvFGNh91Sx6ARoLz1abJkVfMpRtntKTXe,12D3KooWQKskLpVqHr3UqmgbJP7RA3JEXyYyfdWfxVft9kAutbtH,12D3KooWLVWPGedVvY1HtqKaxYQnsuW74biNhAaau6HNkW7peyKC,12D3KooWD7PXStjeFGB2mPyp5PrVufSUMT5uGfBL6e86a9S3f6k3,12D3KooWNkTg4b96FU3KhBJu32RDVjSeH2mkAP7QqAtMdZP4XRWc,12D3KooWL5TJ1VhqZmicWsXtCyge1ZDqTqwYMTUBMPVoy55YQwgG,12D3KooWRZsu7ZeT8k3td6MRkaPMofEjJSspbJXfampDCXtWcrcr,12D3KooWSu8A6YwQiLphJyovsnFxXtzSyiPAubNVu666uTtk9Fw5,12D3KooWN454hCZ32YaGVbggLYefq2AJfHjae42bUdMj6Lv736J3,12D3KooW9uThNo3MNB9aYF1xzjqy7RGjBQjiQpeyA77u3TohcFc6,12D3KooWEZS1tHX2Jkwypz9nSMN9BhAKPQRpLqQGReR7f7hjbeSj,12D3KooWCUSCGzM8VzM3puoAidEzwzRxxeRxLneSaxy6Z78ui9hV,12D3KooWCAj1azMhgLMWkbF12igcgsR1vJGVoe3qPN1agarF9qVZ,12D3KooWAqNJ3PzGsqed5FvQsQ4aaD5e51bjWYQFupvobqEGNqbE,12D3KooWSzpTV5rLhdXVR9nduCE6Paxykdhh9xd5bmqR7aY6Fgaw,12D3KooWLFm2zkAFwmR9qMSVHyfpKNdzrbfYw2X4iWgBwqfb482r,12D3KooWQgmve2ZyEUWkLDJQPDk51fLh7NrxN3wMBhxrGAeKKs26,12D3KooWD7mJuPuTtp5UD7e3wquFFaMPGMoS15TaaFairokPizem,12D3KooWAwKr1jKoQjtDwJE7doNchM2D3VCkSWJuWjRCcVDCs4Kr,12D3KooWMeq37zVhzBvup7Nbdjj4psrnDoJQJeQZJUoSpcgLZWdB,12D3KooWNTbe6ucTJ6mH2a4T1anGSPfKr551sxRfDqS4c4cQgyK3,12D3KooWQQGgeHxmiMNFeaUjuPQsR17G7xXnnw6oreoAU6eywqXV,12D3KooWHXm8475RYy5dzeKWWmptEq6VKNgU9cAA1Vec73cYxBme,12D3KooWAk1KGYrx9PRMX7WfgCisWwJ4BGETbZLhaeP9rMJhtXmg,12D3KooWC3pPyVdBjVFybrqe68Bu5Uv9Z1D3k3VmXv6Pj81e5tET,12D3KooWLgBdE5oY3RU8fF2NgL6gFxYDSsFXyuVeXmETEUURMkue,12D3KooWKf44xjkFQBWELgZM5L92rCyjCKApqZyNYbbqCuKUrDXY,12D3KooWMLU6uqcqq4Y46Zee5RYRVzEa1orUWBCZmSVHKCWZssdc,12D3KooWAMbdhjBwUh2yyKVcZmFfoRGazgnado7Zqt7MpmX8jkEq,12D3KooWPjZVVSVsjipCDchaMgYFj3sffuJF92u3VG8q5ZLmzC5Y,12D3KooWFGdUCssa2VCpgPvLmMLREhE7F22ei8ocYsZDwHq6odkm,12D3KooWJLa2R6XQjEackRT5s3n9TLuns3TBx5XY59axw8CAywBs,12D3KooWPkJZsSDzVXMxXLqpBpDWJKM8JRR1XMSS51W7h5bXjGKx,12D3KooWKxXUg5skmwC26t8puqo67Af8oe3vWWsi9pw6oQ2EtMRm,12D3KooWK6EKk5igwpvgrgc6NnjT8ng3Jba4osUKiZuZRFemLRof,12D3KooWCXp3pkDoq1tRrof6EL1TkGooAK4PkgtrfriFGk28dV47,12D3KooWAHRVN5emAjfGxpPK7ToQkKb3dLdSRLsrrsbDSgVKFDzT,12D3KooWFxyALpNkGvyCJhUUhmQRgTTLDwPkMvPyyLgohFYq9cj4,12D3KooWH62tDC8uexqo4rJZp9RyeHSoPNsxgv4bk2UZfmmvKZ5K,12D3KooWHYXbDkaFgpczDPwQhSSVrVjvT6REdaTit6sB51DMXrfj,12D3KooWE5n4hT7hAB8iYdXd7odehNw7QYTwoF4yrDGFqaLAWDHh,12D3KooWSzPeHsfxULJwFiLeq6Qsx6TruezAwjZ619qsLhqC7cUR,12D3KooWNGdEk6m4U12SfzfKeqMAfV96UyZSoXSkxAMp6ySqQBPL,12D3KooWMPvQRsshJGYjyQnSUSMcwZPawhnBFLdC5GjE3Gs65JvF,12D3KooWF7jjTaY9zcYaq3YoNyPGshQZAGwmsYUdZ3yLo2xS6zs1,12D3KooWCnw1e553UK5EE6muKDGDFXNAR45hYdsPGcGd12WkRLQf,12D3KooWA8JY6ZAHrnwY3ZyVrBmr4Ew9PWF9tmRHSiV9WKwVXUXF,12D3KooWL4oguAYeRKYL6xv8S5wMwKjLgP78FoNDMECuHY6vAkYH,12D3KooWPwWjSjnPDeF2mWoDmD7EuoGRhmE9YNHmJt9mA1BhSd1v,12D3KooWML69apAHmCcejkmWVRpEoBxsjs3siJCGyU7xQGmeDYck,12D3KooWHwJdmDu1GrGgFHDwxz7r3i5N847LQTWhJmFWy8GkS7Gz,12D3KooWE98wZToAzdofkBYKDASqDGcKKjpRo12ELFarUEd91iAU,12D3KooWAUoQTMEaJGcm1ogF7PqYF4TsEfEymxRrbvpLd6ATRhMF,12D3KooWCKMp6TQ6DdHrgkKN6cUWRPwb1Ny2aWp2RutMvxEfs1R6,12D3KooWCT4evRffZ6MFk23aSp3RCQhx9Uv5A4UiXi8Rijyjz5LP,12D3KooWDSDPzcxTZPhbQNmBako5Ddz3fu8Ja2mT7XMSEmCwhWy3,12D3KooWKNWC2xLwipfAhKpfmjeieBpE69rHWtSnLk8RU9C58uWg,12D3KooWPiQVphdwwsMXNxv3M2HC7U5HWQPo7TgG31KjpS4g1XrJ,12D3KooWGxo28ZYA7FAJft2TKC4pfqbPvCtzXqqD3D9mZDTkUT4F,12D3KooWDsdz3CHTA7DZcSdxzAfuGropqKBKRWc3ERQN5o2QekUB,12D3KooWGPWbqF7qGPHdVUGr9karRMMD2pXwZr2f2grXNwgGnHUQ,12D3KooWKbpEULNpDsx1pi39GYUECQ1XReAsKpfiR1J79amC8FM5,12D3KooWG8THpfuHW9cj2m9nbrJJHeHy2asZnoEtYRxshhGdadMG,12D3KooWSbNLGMYeUuMSXDiHwbhXHzTJaWZzH95MZzeAob9BeB51,12D3KooW9xqZ9fmXLMDTu5Nqxf9LVarWkEPV89CzrAbfFJQMeLT4,12D3KooWPToGJ2YLfYRn6QKQcYT7dwNZD39w3KkMpWjDt8csr8Rf,12D3KooWAN97c27n3Z7PCGcTTPSnYoyKoQBbgPirmkUVKWNzNXdV,12D3KooWSVRJsLvHi6LGTsAZDdM4ACkAo4G5MWkctbmrCMgbWBJ5,12D3KooWHYGoPkzkQ2wdXqBgBvqktBoUZxpekwmYbxowTP8GJypR,12D3KooWLaHEAVfncfKmPBpF1CYEazxA2ShmnoyK68G1zxV3K2oH,12D3KooWH1NjW8aVxQvgLBJxEgXpJoevJWW7nBWJzoFBaoq9nHqH,12D3KooWD9Su4tNbRGwbieLEXc2f8U2mnWa2vHNvYnVm7hoHDKC5,12D3KooWP1pnn2fZHhQe6FqgfC6dQxwBLfA9D5vcxuphQn2FWHD1,12D3KooWRWnf1GrBK9aHBxXHyYerkV7jPkAjgskAQoahbJf1cUmU,12D3KooWCBBUEx8xwh14oGkawsnAsitYQ4QvYCUh9EVTMarKisfv,12D3KooWNcgU2zDENb2YLpQAMnAn2898528gi3qNXGmoiY4CaafT,12D3KooWMPAAKf7m9DWXCSepBS9gY6oTmeHw18PKDJMYuresYNhf,12D3KooW9swwwtAj83nNXZjvzNUvV1pqEqoY7MMr8ZCU5yRaSbXQ,12D3KooWQYqa9NwN5rHxZE5Gtu5H1N4ZpLSAuQL3K73APW4J6ySr,12D3KooW9ysPDWCkJPCrYX1rctZ8k8QzhXLqTfgvW51bi2JGY8f4,12D3KooWDzrdGvp3NwNkBPrXDerhh2QvtAnj6pMeBqDevUZ43ctg,12D3KooWEa6RBF7H7GQD9Smcj6hns2phunQ1BFLCUYfkK6dXpkrz,12D3KooWBP5Yi9v1swwG7cMvfByx5Q5U5ZwaANSvybZ9SciMUpv3,12D3KooWPg2uw1B2ZA4cbWDGXQ6bnAm6W8rndpPangmwdCXDaPcE,12D3KooWLCjAbJAFLqTodVfu4CAnMtcZafoiCSCvg2226qt7zqGZ,12D3KooWBNLBK4GEnSn4onf1pjX51pVBiCyHbNWRU1jgDNaG2BoH,12D3KooWSFJ8MzaHEiJDFkiMXzzQ1FeE5X3DwvoWdsAgCFfuH8qQ,12D3KooWFBZZnKcWiNyEgSDy7YsSTLUQrotMbgPWUnDagVcuhCkf,12D3KooWKA72bv4F7RdsfKDCEgHwG2DK8WRYQW8oejudyC8rqENj,12D3KooWJxj5uocVccSciLK99vkZrF3qrh9AmfxoUegaYmkdJxHH,12D3KooWH8ApuohGXjLcH3Pmjhd691TE83rTr5EjhiNkx5ZER4ww,12D3KooWHo2MsUcFfXCdDF5FtCMp5S4AG5zuwKwc1ai2XL6zBwZJ,12D3KooWDEa3EKpsZwgQA61hTkeaeUjEwtCeJVsd1gL4JjvAphJL,12D3KooWHhhwT35bqv4CAb1gYMk2pCY3nRM1yj2AzqgLSuG9bz81,12D3KooWKFQqAXwz1Q3mpZDkqkYNPhkbQhJExMsmYifypb92mc5w,12D3KooWKTrwTxkVMEMjEXJLXJrnwGnTPRKtaNBfc9nAxci5mjNB,12D3KooWCsBnt9radCDxhvhFfHtfXnHBCHen5HiPXe2LRSkWoDK3,12D3KooWK3rWCYssQkQHHm5q1K1qHUBRgmEp18sHDnxRRtL5kPsb,12D3KooWMZcxDe4NMwT1EHYwduyzdLY1uRAanBGRGqYq8KGCtafN,12D3KooWAgze9Y27W9smQCKt2NZRFMGZGJdBiTkRhH2bTF6zXhSX,12D3KooWC8epdU21YmnEUDa18EVFwtpMFzJgtE43PaZLTpEwuokv,12D3KooWMbioHP8KuXHoa932q1hcUfhaN8KNyn9WuMiAF4tSrGMh,12D3KooWSv9VQ2EZiokN8dZLsoE9vzGxw79pQmoBfDWMPQHBvLxv,12D3KooWShsGKn1wfYYzneopXR4zvQU6YQsarKoKmEc71aboEnWj