Repository navigation
feat: keep the scans a moderator has to judge a payout on #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Push image | |
| # CI only builds + pushes the image to GHCR. Deployment is handled by GitOps | |
| # (Argo CD) in the umbrella repo, which rolls out new :main digests. | |
| # Runs on every push to main (force-push included) and on manual dispatch. | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: build-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository }} # ghcr.io/shopnexus/server | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build & push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| # Explicit, not "the last stage wins": the Dockerfile also has a `dev` | |
| # stage with the Go toolchain and air, which must never ship. | |
| target: runtime | |
| push: true | |
| tags: | | |
| ${{ env.IMAGE }}:main | |
| ${{ env.IMAGE }}:sha-${{ github.sha }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # The docs site fetches api/openapi.gen.yaml at build time, so it only follows | |
| # this repo if something tells it to rebuild. Fired unconditionally: the docs | |
| # image COPYs the spec, so an unchanged spec yields the same digest and no | |
| # rollout. Needs a PAT — GITHUB_TOKEN cannot dispatch to another repo. | |
| # | |
| # The commit sha travels with the event, and it is not decoration. Left to fetch | |
| # `main`, the docs build races a CDN: raw.githubusercontent serves a branch ref with | |
| # `cache-control: max-age=300`, and this dispatch arrives seconds after the push — so | |
| # for up to five minutes that URL can still return the previous spec. Docs would then | |
| # publish the old file and nothing would rebuild again, which is the exact staleness | |
| # this job exists to remove, except now it looks like it worked. A sha-pinned URL is | |
| # immutable, so caching it is correct rather than a hazard. | |
| notify-docs: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Trigger docs rebuild | |
| env: | |
| TOKEN: ${{ secrets.DOCS_DISPATCH_TOKEN }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| if [ -z "$TOKEN" ]; then | |
| echo "::warning::DOCS_DISPATCH_TOKEN is not set — the docs site will keep serving the previous OpenAPI spec. See 'Publishing the API spec to docs' in deploy/README.md of the umbrella repo." | |
| exit 0 | |
| fi | |
| curl -fsS -X POST \ | |
| -H "Authorization: Bearer $TOKEN" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| -H "X-GitHub-Api-Version: 2022-11-28" \ | |
| https://api.github.com/repos/shopnexus/docs/dispatches \ | |
| -d "{\"event_type\":\"spec-updated\",\"client_payload\":{\"sha\":\"$SHA\"}}" | |
| echo "dispatched spec-updated to shopnexus/docs at $SHA" |