name: Build and Push Container Images

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:
    branches:
      - main
  workflow_dispatch:
    inputs:
      ref-name:
        type: string
        description: "The ref to build a container image from. For example a tag v23.0.0."
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ inputs.ref-name || github.ref }}
  cancel-in-progress: true

jobs:
  build:
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - build:
              name: default
          - build:
              name: agents
              prefix: agents
              build-args: "FEATURE_TOGGLE=-DENABLE_AGENTS=1"
          - build:
              name: container scanning
              prefix: container-scanning
              build-args: "FEATURE_TOGGLE=-DENABLE_OPENVASD=1 -DENABLE_CONTAINER_SCANNING=1"
          - build:
              name: credential stores
              prefix: credential-stores
              build-args: "FEATURE_TOGGLE= -DENABLE_CREDENTIAL_STORES=1"
    name: Build and Push Container Images (${{ matrix.build.name }})
    uses: greenbone/workflows/.github/workflows/container-build-push-gea.yml@main
    with:
      ref: ${{ inputs.ref-name }}
      ref-name: ${{ inputs.ref-name }}
      name: ${{ matrix.build.name }}
      build-args: ${{ matrix.build.build-args }}
      prefix: ${{ matrix.build.prefix }}
      images: |
        ghcr.io/${{ github.repository }},enable=true
        ${{ vars.GREENBONE_REGISTRY }}/community/${{ github.event.repository.name }},enable=${{ github.event_name != 'pull_request' && matrix.build.name == 'default' }}
        ${{ vars.GREENBONE_REGISTRY }}/openvas-scan-dev/${{ github.event.repository.name }},enable=${{ github.event_name != 'pull_request' && matrix.build.name == 'default' }}
    secrets: inherit

  notify:
    needs:
      - build
    if: ${{ !cancelled() && github.event_name != 'pull_request' && github.repository == 'greenbone/gvmd' }}
    uses: greenbone/workflows/.github/workflows/notify-mattermost-2nd-gen.yml@main
    with:
      status: ${{ contains(needs.*.result, 'failure') && 'failure' || 'success' }}
    secrets: inherit

  trigger-replication:
    needs:
      - build
    if: ${{ !cancelled() && github.event_name != 'pull_request' && github.repository == 'greenbone/gvmd' }}
    runs-on: self-hosted-generic
    steps:
      - name: Ensure all tags are replicated on the public registry
        uses: greenbone/actions/trigger-harbor-replication@v3
        if: ${{ github.event_name != 'pull_request' }}
        with:
          registry: ${{ vars.GREENBONE_REGISTRY }}
          token: ${{ secrets.GREENBONE_REGISTRY_REPLICATION_TOKEN }}
          user: ${{ secrets.GREENBONE_REGISTRY_REPLICATION_USER }}

  automatix:
    name: Update Automatix
    if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') }}
    needs: build
    uses: greenbone/workflows/.github/workflows/automatix-service.yml@main
    with:
      service: openvas-gvmd
      url: ${{ vars.GREENBONE_REGISTRY }}/openvas-scan-dev/${{ github.event.repository.name }}
      tag: ${{ github.ref_name }}
      artifact-pattern: default
    secrets: inherit
