talos.yml

name: Talos Runner Image

on:
  push:
    branches:
      - talos
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    # Job-level env so step-level `if: env.RAILWAY_TOKEN != ''` can see it.
    # Step-level env is not visible in that step's own `if:` expression.
    env:
      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Set up SSH agent for @automaton/client deploy key
        uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd  # v0.9.1
        with:
          ssh-private-key: ${{ secrets.TALOS_DEPLOY_KEY }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca  # v3.9.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare image metadata
        id: prep
        run: |
          IMAGE_NAME="ghcr.io/${{ github.repository_owner }}/arm-actions"
          IMAGE_NAME="$(echo "${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')"
          echo "image_name=${IMAGE_NAME}" >> "${GITHUB_OUTPUT}"

      - name: Build and push image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5.4.0
        with:
          context: .
          file: ./dockerfile-actions
          push: true
          ssh: default
          tags: ${{ steps.prep.outputs.image_name }}:${{ github.sha }}

      # Two-step deploy: pin the service to the SHA-tagged image we just
      # pushed, then create a fresh deployment from that updated config.
      # `serviceInstanceUpdate` alone changes settings but does not deploy;
      # any "redeploy" mutation (`environmentTriggersDeploy`,
      # `serviceInstanceRedeploy`) re-runs the *previous* deployment object,
      # which still references the old image tag. `serviceInstanceDeployV2`
      # creates a new deployment from current config — the API equivalent
      # of clicking "Deploy" in the Railway UI.
      - name: Pin Railway service to new image
        if: success() && env.RAILWAY_TOKEN != ''
        env:
          RAILWAY_SERVICE_ID: ${{ secrets.RAILWAY_SERVICE_ID }}
          RAILWAY_ENVIRONMENT_ID: ${{ secrets.RAILWAY_ENVIRONMENT_ID }}
          IMAGE: ${{ steps.prep.outputs.image_name }}:${{ github.sha }}
        run: |
          set -euo pipefail
          if [ -z "${RAILWAY_ENVIRONMENT_ID:-}" ]; then
            echo "::error::RAILWAY_ENVIRONMENT_ID secret is required for image-pinned deploys." >&2
            echo "::error::Find it in Railway: open the service, the URL contains /environment/<id>." >&2
            echo "::error::Add it under Settings → Secrets and variables → Actions." >&2
            exit 1
          fi

          payload=$(jq -n \
            --arg serviceId "$RAILWAY_SERVICE_ID" \
            --arg environmentId "$RAILWAY_ENVIRONMENT_ID" \
            --arg image "$IMAGE" \
            '{
              query: "mutation($serviceId: String!, $environmentId: String!, $input: ServiceInstanceUpdateInput!) { serviceInstanceUpdate(serviceId: $serviceId, environmentId: $environmentId, input: $input) }",
              variables: {
                serviceId: $serviceId,
                environmentId: $environmentId,
                input: { source: { image: $image } }
              }
            }')

          # Personal / account tokens authenticate via `Authorization: Bearer`.
          # Project tokens use `Project-Access-Token` instead.
          # See https://docs.railway.com/integrations/api.
          response=$(curl -fsSL -X POST https://backboard.railway.com/graphql/v2 \
            -H "Authorization: Bearer $RAILWAY_TOKEN" \
            -H "Content-Type: application/json" \
            -d "$payload")

          echo "$response"
          if echo "$response" | jq -e '.errors' > /dev/null; then
            echo "::error::Railway API returned errors — see response above" >&2
            exit 1
          fi

          echo "✓ Pinned service image to $IMAGE."

      - name: Deploy updated image on Railway
        if: success() && env.RAILWAY_TOKEN != ''
        env:
          RAILWAY_SERVICE_ID: ${{ secrets.RAILWAY_SERVICE_ID }}
          RAILWAY_ENVIRONMENT_ID: ${{ secrets.RAILWAY_ENVIRONMENT_ID }}
        run: |
          set -euo pipefail
          payload=$(jq -n \
            --arg serviceId "$RAILWAY_SERVICE_ID" \
            --arg environmentId "$RAILWAY_ENVIRONMENT_ID" \
            '{
              query: "mutation($serviceId: String!, $environmentId: String!) { serviceInstanceDeployV2(serviceId: $serviceId, environmentId: $environmentId) }",
              variables: {
                serviceId: $serviceId,
                environmentId: $environmentId
              }
            }')

          response=$(curl -fsSL -X POST https://backboard.railway.com/graphql/v2 \
            -H "Authorization: Bearer $RAILWAY_TOKEN" \
            -H "Content-Type: application/json" \
            -d "$payload")

          echo "$response"
          if echo "$response" | jq -e '.errors' > /dev/null; then
            echo "::error::Railway API returned errors — see response above" >&2
            exit 1
          fi

          echo "✓ Triggered deploy."