deploy-image.yml

name: Create and publish a Docker image

on:
  push:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  BRANCH: ${{ github.ref }}

jobs:
  # The workflow's DAG properties, checked through the host launcher: Snakemake
  # on the image's Python with sp_validation absent, as on a user's machine.
  workflow-dag:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0

      - name: DAG tests
        run: >-
          uv run --isolated --no-project --python 3.12
          --with snakemake --with snakemake-executor-plugin-slurm
          --with pytest
          pytest workflow/tests -m "not candide"

  build-and-push-image:
    runs-on: 
      - ubuntu-latest
      # - macos-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and export to Docker
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Import smoke test
        run: docker run --rm ${{ steps.meta.outputs.tags }} python -c "import sp_validation"

      # Run the fast test suite against the freshly-built image *before*
      # pushing, so a failing suite blocks publication. The image carries the
      # full stack and the test files (COPY . + editable install), so this
      # needs no extra setup.
      - name: Run unit tests
        run: docker run --rm ${{ steps.meta.outputs.tags }} python -m pytest src/sp_validation/tests -m "not slow"

      - name: Push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}