build-and-publish.yml

name: Build and Publish
run-name: Build and Publish ${{ inputs.ref }} to ${{ inputs.app_name }} ${{ inputs.environment || (github.event_name == 'release' && 'prod') || 'nonprod' }}

on:
  workflow_call:
    inputs:
      app_name:
        description: "name of application folder under infra directory"
        required: true
        type: string
      ref:
        description: The branch, tag or SHA to checkout. When checking out the repository that triggered a workflow, this defaults to the reference or SHA for that event. Otherwise, use branch or tag that triggered the workflow run.
        required: true
        type: string
      environment:
        description: "The environment where the build will be deployed. eg. dev or prod. Will default to dev."
        default: dev
        required: false
        type: string
  workflow_dispatch:
    inputs:
      app_name:
        description: "name of application folder under infra directory"
        required: true
        type: string
      ref:
        description: The branch, tag or SHA to checkout. When checking out the repository that triggered a workflow, this defaults to the reference or SHA for that event. Otherwise, use branch or tag that triggered the workflow run.
        required: true
        type: string
      environment:
        description: "The environment where the build will be deployed. eg. dev or prod. Will default to dev."
        default: dev
        required: false
        type: string

jobs:
  build-and-publish:
    name: Build and publish
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.7
          terraform_wrapper: false

      - name: Configure AWS credentials
        uses: ./.github/actions/configure-aws-credentials
        with:
          app_name: ${{ inputs.app_name }}
          environment: shared

      - name: Check if image is already published
        id: check-image-published
        run: |
          is_image_published=$(./bin/is-image-published "${{ inputs.app_name }}" "${{ inputs.ref }}")
          echo "Is image published: $is_image_published"
          echo "is_image_published=$is_image_published" >> "$GITHUB_OUTPUT"

      - name: Build release
        if: steps.check-image-published.outputs.is_image_published == 'false'
        run: make APP_NAME=${{ inputs.app_name }} release-build

      - name: Publish release
        if: steps.check-image-published.outputs.is_image_published == 'false'
        run: make APP_NAME=${{ inputs.app_name }} release-publish