build.yml

name: "Build CLI and attach to GitHub release"

on:
  release:
    types: [published]

  workflow_dispatch:

permissions:
  attestations: write
  contents: write
  id-token: write
  pull-requests: write
  packages: write

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  release:
    uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@8244c7c9142e92281e7841f655fa48e9ceb9b454 # main
    secrets: inherit

  homebrew:
    if: ${{ github.event.release.prerelease == false }}
    name: "Bump Homebrew formula"
    runs-on: ubuntu-latest
    needs: release
    environment: release
    steps:
      # mislav/bump-homebrew-formula-action is broken: GitHub now returns HTTP 303
      # instead of 302 for tarball redirects and the action only accepts 302.
      # See https://github.com/mislav/bump-homebrew-formula-action/issues/340
      - uses: dawidd6/action-homebrew-bump-formula@1446dca236b0440c6f02723a3f14f13be2c04ab0 # v7
        with:
          token: ${{ secrets.GH_BOT_TOKEN }}
          formula: atmos

  docker:
    name: "Build and push Docker image for Atmos CLI"
    runs-on: ubuntu-latest
    needs: release
    if: ${{ github.event_name == 'release' }}
    steps:
      - name: "Checkout source code at current commit"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Docker Build"
        id: build
        uses: cloudposse/github-action-docker-build-push@02993d675b44dcc7082e6de7485c1ff8740bce9d # v3.1.0
        with:
          registry: ghcr.io
          organization: "${{ github.event.repository.owner.login }}"
          repository: "${{ github.event.repository.name }}"
          login: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"
          platforms: linux/amd64,linux/arm64
          binfmt-image: mirror.gcr.io/tonistiigi/binfmt:qemu-v7.0.0
          file: Dockerfile
          build-args: |
            ATMOS_VERSION=${{ github.event.release.tag_name }}

      - name: "Verify Image"
        env:
          DOCKER_IMAGE: ${{ steps.build.outputs.image }}
          DOCKER_TAG: ${{ steps.build.outputs.tag }}
        run: |
          docker pull "$DOCKER_IMAGE:$DOCKER_TAG"

      - name: "Job Summary"
        env:
          DOCKER_IMAGE: ${{ steps.build.outputs.image }}
          DOCKER_TAG: ${{ steps.build.outputs.tag }}
        run: |
          echo "## Docker Image Summary" >> $GITHUB_STEP_SUMMARY
          echo '```json' >> $GITHUB_STEP_SUMMARY
          docker inspect "$DOCKER_IMAGE:$DOCKER_TAG" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY