master_push.yml

name: Tag, Build, and Push Image

on:
  push:
    branches: [ master ]
    paths-ignore: [ '**.md' ]
  workflow_dispatch:
    inputs:
      bump:
        description: 'Part of the version to bump: major, minor, patch'
        required: false
        default: 'patch'
        type: choice
        options:
          - patch
          - minor
          - major
      branch:
        description: 'Branch to run the workflow on'
        required: false
        default: 'master'

env:
  SERVICE_NAME: ${{ github.event.repository.name }}
jobs:
  tag-build-push:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
      is-bump: ${{ steps.skiptest.outputs.is-bump }}
    steps:
      - name: Set part of semantic version to bump
        id: controls
        run: |
          SEMVER_PART=""
          CHECKOUT_BRANCH="$GITHUB_REF"
          if ${{github.event_name == 'push' }}; then
            SEMVER_PART="patch"
          elif ${{github.event_name == 'workflow_dispatch' }}; then
            SEMVER_PART=${{ github.event.inputs.bump }}
            CHECKOUT_BRANCH=${{ github.event.inputs.branch }}
          fi
          echo semver-part=$SEMVER_PART >> $GITHUB_OUTPUT
          echo checkout-branch=$CHECKOUT_BRANCH >> $GITHUB_OUTPUT
      - name: Checkout current code
        uses: actions/checkout@v3
        with:
          ref: ${{ steps.controls.outputs.checkout-branch }}
          token: ${{ secrets.BROADBOT_TOKEN }}
      - name: Skip version bump merges
        id: skiptest
        uses: ./.github/actions/bump-skip
        with:
          event-name: ${{ github.event_name }}
      - name: Bump the tag to a new version
        if: steps.skiptest.outputs.is-bump == 'no'
        uses: databiosphere/github-actions/actions/bumper@bumper-0.1.0
        id: tag
        env:
          DEFAULT_BUMP: patch
          GITHUB_TOKEN: ${{ secrets.BROADBOT_TOKEN }}
          HOTFIX_BRANCHES: hotfix.*
          OVERRIDE_BUMP: ${{ steps.controls.outputs.semver-part }}
          RELEASE_BRANCHES: master
          VERSION_FILE_PATH: settings.gradle
          VERSION_LINE_MATCH: "^\\s*gradle.ext.rbsVersion\\s*=\\s*'.*'"
          VERSION_SUFFIX: SNAPSHOT
      - name: Auth to GCR
        if: steps.skiptest.outputs.is-bump == 'no'
        uses: google-github-actions/auth@v1
        with:
          version: '411.0.0'
          credentials_json: ${{ secrets.GCR_PUBLISH_KEY_B64 }}
      - name: Setup gcloud
        if: steps.skiptest.outputs.is-bump == 'no'
        uses: google-github-actions/setup-gcloud@v1
      - name: Explicitly auth Docker for GCR
        if: steps.skiptest.outputs.is-bump == 'no'
        run: gcloud auth configure-docker --quiet
      - name: Set up JDK 17
        if: steps.skiptest.outputs.is-bump == 'no'
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17
      - name: Grant execute permission for gradlew
        if: steps.skiptest.outputs.is-bump == 'no'
        run: chmod +x gradlew
      - name: Build and push GCR image using Jib
        if: steps.skiptest.outputs.is-bump == 'no'
        run: "./gradlew jib --image=gcr.io/broad-dsp-gcr-public/${SERVICE_NAME}:${{ steps.tag.outputs.tag }}"
  report-to-sherlock:
    # Report new RBS version to Broad DevOps
    uses: broadinstitute/sherlock/.github/workflows/client-report-app-version.yaml@main
    needs: tag-build-push
    if: ${{ needs.tag-build-push.outputs.is-bump == 'no' }}
    with:
      new-version: ${{ needs.tag-build-push.outputs.tag }}
      chart-name: 'buffer'
    permissions:
      contents: 'read'
      id-token: 'write'

  set-version-in-dev:
    # Put new RBS version in Broad dev environment
    uses: broadinstitute/sherlock/.github/workflows/client-set-environment-app-version.yaml@main
    needs: [tag-build-push, report-to-sherlock]
    if: ${{ needs.tag-build-push.outputs.is-bump == 'no' }}
    with:
      new-version: ${{ needs.tag-build-push.outputs.tag }}
      chart-name: 'buffer'
      environment-name: 'dev'
    secrets:
      sync-git-token: ${{ secrets.BROADBOT_TOKEN }}
    permissions:
      id-token: 'write'