# Builds a QA GHCR image for a PR when the "PR: Ready for QA" label is present.
# Triggers on:
#   - "PR: Ready for QA" label added to a PR
#   - New commits pushed to a PR that already has the label will trigger a new build
name: Build QA GHCR Image

on:
  pull_request:
    types: [labeled, synchronize]
    paths-ignore:
      - "**.md"
      - ".gitmodules"
      - "cloud-deployments/**/*"
      - "images/**/*"
      - ".vscode/**/*"
      - "**/.env.example"
      - ".github/ISSUE_TEMPLATE/**/*"
      - ".devcontainer/**/*"
      - "embed/**/*"
      - "browser-extension/**/*"
      - "extras/**/*"

concurrency:
  group: qa-build-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  build:
    name: Build and push QA image for PR
    runs-on: ubuntu-22.04-arm
    # Run when labeled with "PR: Ready for QA"
    if: >-
      ${{ contains(github.event.pull_request.labels.*.name, 'PR: Ready for QA') }}
    permissions:
      packages: write
      contents: read
      pull-requests: write
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: v0.22.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set lowercase repository owner
        run: echo "REPO_OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/Dockerfile
          push: true
          sbom: true
          provenance: mode=max
          platforms: linux/arm64
          tags: ghcr.io/${{ env.REPO_OWNER_LC }}/${{ github.event.repository.name }}:pr-${{ github.event.pull_request.number }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
