preview.yaml

name: preview

on:
  # pull_request_target を使うにあたって https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ の一読を推奨
  pull_request_target:

permissions:
  packages: write

env:
  IMAGE_NAME: traportfolio-ui

jobs:
  # API生成部分をDockerのビルド部分から分離
  genApi:
    name: Generate APIs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
      - run: npm ci
      - run: npm run gen-api
      - uses: actions/upload-artifact@v4
        with:
          name: apis
          path: ./src/lib/apis/generated

  build-preview-image:
    name: Build Preview Image
    needs:
      - genApi
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
      - name: Builder instance name
        run: echo ${{ steps.buildx.outputs.name }}
      - name: Available platforms
        run: echo ${{ steps.buildx.outputs.platforms }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: traptitech
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/download-artifact@v4
        with:
          name: apis
          path: ./src/lib/apis/generated

      # Docker 内でビルドを行うことで、write perm つきでの任意コード実行を避ける
      # workflow 自体の改竄はないが、悪意のあるソースコードが入った場合に secret が抽出される可能性があるためである
      - name: Build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ghcr.io/traptitech/${{ env.IMAGE_NAME }}:preview-${{ github.event.number }}-${{ github.event.pull_request.head.sha }}
          cache-from: type=registry,ref=ghcr.io/traptitech/${{ env.IMAGE_NAME }}:buildcache