build-deploy-release-multi.yaml

#
# Builds tests amd64 and arm64 images (separately, to reduce image size)
#
name: build-deploy-release-multi
on:
  release:
    types: [published]

jobs:
  build:

    strategy:
      fail-fast: false
      matrix:
        os: 
          - ubuntu-22-amd64-4-16
          - ubuntu-22-arm64-4-16
        include:
          - os: ubuntu-22-amd64-4-16
            platform: linux/amd64
          - os: ubuntu-22-arm64-4-16
            platform: linux/arm64

    runs-on: ${{ matrix.os }}

    permissions:
      contents: read
      id-token: write

    env:
      registry: us-west1-docker.pkg.dev
      image: geocoder

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with: 
          images: ${{ env.registry }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ env.image }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: ${{ matrix.platform }}

      - name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          project_id: ${{ secrets.PROJECT_ID }}
          workload_identity_provider: ${{ secrets.IDENTITY_PROVIDER }}

      - name: Set up Cloud SDK
        uses: 'google-github-actions/setup-gcloud@v2'
        with:
          version: '>= 363.0.0'

      - name: Configure docker for Google artifact registry
        id: docker
        run: gcloud auth configure-docker ${{ env.registry }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v5
        with:
          provenance: false
          context: .
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          outputs: |
            type=image,name=${{ env.registry }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ env.image }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
          cache-to: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
      
      - name: Export digest
        run: |
          mkdir -p /tmp/digests/${{ env.image }}
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${{ env.image }}/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.image }}-digests-${{ matrix.os }}
          path: /tmp/digests/${{ env.image }}/*
          if-no-files-found: error
          retention-days: 1

      - name: Clear digest
        run: |
          rm -rf /tmp/digests/${{ env.image }}

  merge:

    env:
      registry: us-west1-docker.pkg.dev
      image: geocoder

    strategy:
      fail-fast: false

    runs-on: ubuntu-22-amd64-4-16

    permissions:
      contents: read
      id-token: write

    needs:
      - build

    name: Merge Docker manifests

    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          pattern: ${{ env.image }}-digests-*
          merge-multiple: true
          path: /tmp/digests/${{ env.image }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with: 
          images: ${{ env.registry }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ env.image }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          project_id: ${{ secrets.PROJECT_ID }}
          workload_identity_provider: ${{ secrets.IDENTITY_PROVIDER }}

      - name: Set up Cloud SDK
        uses: 'google-github-actions/setup-gcloud@v2'
        with:
          version: '>= 363.0.0'

      - name: Configure docker for Google artifact registry
        id: docker
        run: gcloud auth configure-docker ${{ env.registry }}

      - name: Create manifest list and push
        working-directory: /tmp/digests/${{ env.image }}
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.meta.outputs.json }}') \
            $(printf '${{ env.registry }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ env.image }}@sha256:%s ' *)
      
      - name: Inspect image
        run: |
          docker buildx imagetools inspect '${{ env.registry }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ env.image }}:${{ steps.meta.outputs.version }}'