name: "Build Gleam"
description: "Build Gleam Container"
inputs:
  version:
    description: "Build Version"
    required: true
  release-id:
    description: "Release ID"
    required: true

runs:
  using: composite
  steps:
  - name: Download Gleam release assets
    uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
    with:
      releaseId: "${{ inputs.release-id }}"
      fileName: "gleam-${{ inputs.version }}-{x86_64-unknown-linux-musl,aarch64-unknown-linux-musl}.*"

  - name: "Unpack release files into correct location"
    shell: bash
    run: |
      declare -A ARCH
      ARCH["amd64"]="x86_64-unknown-linux-musl"
      ARCH["arm64"]="aarch64-unknown-linux-musl"

      for SHORT in "${!ARCH[@]}"; do
        LONG="${ARCH[$SHORT]}"

        # Unpack Release
        tar xf "gleam-$VERSION-$LONG.tar.gz"

        # Move files into place
        mv gleam "gleam-$SHORT"

        # The SBoM is added to the images so that the Docker Scout Scanner is
        # able to find the info about the gleam binary since it was not
        # installed by the operating system package manager.
        mv "gleam-$VERSION-$LONG.tar.gz.sbom.spdx.json" "gleam-$SHORT.sbom.spdx.json"

        # Delete Unused Files
        rm -rf "gleam-$VERSION-$LONG*"
      done
    env:
      VERSION: "${{ inputs.version }}"

  - name: Authenticate with GitHub container registry
    uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
    with:
      registry: ghcr.io
      username: ${{ github.actor }}
      password: ${{ github.token }}

  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

  - name: Build version and tags
    shell: bash
    id: versions
    run: |
      # Build version with platform
      PLATFORM_VERSION=$VERSION_VERSION-${{ matrix.base-image }}

      # Build container tag
      TAG=ghcr.io/${{ github.repository }}:$PLATFORM_VERSION

      echo "platform-version=$PLATFORM_VERSION" >> $GITHUB_OUTPUT
      echo "container-tag=$TAG" >> $GITHUB_OUTPUT
    env:
      VERSION: "${{ inputs.version }}"

  - name: Build and push
    uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
    with:
      context: .
      platforms: linux/amd64,linux/arm64
      file: containers/${{ matrix.base-image }}.dockerfile
      push: true

      # Enabling `provenance` will cause the action to create SLSA build
      # provenance and push it alongside the tagged image. In practical terms,
      # we're adding info to the tag that attests to where, when, and how the
      # asset and image was built.
      #
      # For more info on Docker Attestations, see:
      # https://docs.docker.com/build/ci/github-actions/attestations/
      provenance: true

      # Enabling `sbom` will trigger an SBoM Scan using Docker Scout:
      # https://docs.docker.com/scout/how-tos/view-create-sboms/
      # The scan will detect any operating system packages as well as the Gleam
      # Build SBoM added into the Docker Container.
      #
      # Why is this helpful?
      # * If you build services on top of these container images, you can track
      #   all dependencies that ship with Gleam, plus the rest of your stack in
      #   the image.
      # * This makes it easier to do image-level vulnerability scans and
      #   compliance checks.
      #
      # For more info on Docker SBoMs, see:
      # https://docs.docker.com/build/metadata/attestations/sbom/
      sbom: true
      tags: ${{ steps.versions.outputs.container-tag }}
      labels: |
        org.opencontainers.image.title=gleam
        org.opencontainers.image.url=https://gleam.run
        org.opencontainers.image.source=https://github.com/gleam-lang/gleam
        org.opencontainers.image.version=${{ steps.versions.outputs.platform-version }}
        org.opencontainers.image.licenses=Apache-2.0