build-singularity.yml

name: build-singularity

on:
  # Manual trigger
  workflow_dispatch:
    inputs:
      source_tag:
        description: "GHCR image tag to convert (e.g., v0.3.0, latest, sha-abcdef1)"
        required: true
        default: "latest"
      release_tag:
        description: "GitHub Release tag to upload SIF to (leave blank to skip)"
        required: false
        default: ""

  # Optional automatic trigger from another workflow
  repository_dispatch:
    types: [singularity_build]

permissions:
  contents: write   # upload to releases
  packages: write   # push to GHCR (oras)
  id-token: write   # future-proof if you switch to OIDC for auth

jobs:
  sif:
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io
      IMAGE_OWNER: openswath
      IMAGE_NAME: openswath
      REPO_SIF: ghcr.io/openswath/openswath-sif

    steps:
      - uses: actions/checkout@v4

      - name: Set up Apptainer
        uses: eWaterCycle/setup-apptainer@v2
        with:
          apptainer-version: '1.3.4'

      - name: Work out source & output names
        id: tag
        run: |
          # Prefer repository_dispatch payload, then manual input, then 'latest'
          SRC_TAG="${{ github.event.client_payload.source_tag }}"
          if [ -z "$SRC_TAG" ]; then
            SRC_TAG="${{ github.event.inputs.source_tag }}"
          fi
          if [ -z "$SRC_TAG" ]; then
            SRC_TAG="latest"
          fi
          SAFE_TAG="${SRC_TAG//\//_}"
          echo "SRC_TAG=$SRC_TAG" >> $GITHUB_ENV
          echo "SIF=openswath-${SAFE_TAG}.sif" >> $GITHUB_ENV

      - name: Pull SIF from GHCR (public image)
        run: |
          SRC="docker://${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}:${{ env.SRC_TAG }}"
          echo "Pulling ${{ env.SIF }} from $SRC"
          apptainer pull --force "${{ env.SIF }}" "$SRC"
          ls -lh "${{ env.SIF }}"

      - name: Upload SIF as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.SIF }}
          path: ${{ env.SIF }}
          if-no-files-found: error
          retention-days: 7

      - name: Upload SIF to GitHub Release (manual runs only if tag provided)
        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '' }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.inputs.release_tag }}
          files: ${{ env.SIF }}

      # ---- Push to GHCR as OCI artifact via ORAS ----
      - name: Set up ORAS
        uses: oras-project/setup-oras@v1

      - name: Login to GHCR (for ORAS)
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io \
            --username "${{ github.actor }}" --password-stdin

      - name: Push SIF to GHCR (tag = source_tag)
        run: |
          echo "Pushing ${{ env.SIF }} to ${{ env.REPO_SIF }}:${{ env.SRC_TAG }}"
          oras push "${{ env.REPO_SIF }}:${{ env.SRC_TAG }}" \
            --artifact-type application/vnd.apptainer.sif \
            "${{ env.SIF }}:application/vnd.apptainer.sif"

      - name: Push SIF to GHCR (also tag = release_tag, if provided)
        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_tag != '' }}
        run: |
          echo "Pushing ${{ env.SIF }} to ${{ env.REPO_SIF }}:${{ github.event.inputs.release_tag }}"
          oras push "${{ env.REPO_SIF }}:${{ github.event.inputs.release_tag }}" \
            --artifact-type application/vnd.apptainer.sif \
            "${{ env.SIF }}:application/vnd.apptainer.sif"