pocket-id-pocket-id/.github/workflows/build-next.yml

name: Build Next Image

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: build-next-image
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write
  artifact-metadata: write

jobs:
  build-next:
    runs-on: depot-ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum

      - name: Set up Depot CLI
        uses: depot/setup-action@v1

      - name: Setup depot buildx driver
        run: depot configure-docker

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set Short Git Commit SHA
        id: vars
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7
        with:
          distribution: goreleaser-pro
          version: "~> v2"
          args: release --clean --skip=announce,validate --parallelism=4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUILD_NEXT: "true"
          SKIP_RELEASE: "true"
          SKIP_CHANGELOG: "true"
          GORELEASER_CURRENT_TAG: next-static-${{ steps.vars.outputs.sha_short }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}

      - name: Binary attestation
        uses: actions/attest@v4
        with:
          subject-checksums: ./dist/checksums.txt

      - name: Container image attestation
        uses: actions/attest@v4
        with:
          subject-checksums: ./dist/digests.txt