name: CI
permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - ".github/workflows/ci.yml"
      - "resources/**"
      - "scripts/**"
      - "Dockerfile"

defaults:
  run:
    shell: bash

jobs:
  docker-build:
    name: Test building web-vault
    permissions:
      packages: write # Needed to upload packages and artifacts
      contents: read
    runs-on: ubuntu-24.04
    env:
      # Force docker to output the progress in plain
      BUILDKIT_PROGRESS: plain
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Build and Extract
        run: |
          make docker-extract

      - name: Generate checksum
        run: |
          echo "sha256sum: $(sha256sum container_builds/bw_web_vault.tar.gz)"

      - name: "Upload web-vault artifact"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: web-vault
          compression-level: 0
          path: container_builds/bw_web_vault.tar.gz