Set publish workflows to depend on tests (#197)

- The publish workflow happens in parallel to the tests/health checks.
- This is generally ok since the publishing usually happens from the main branch OR tagged commits on the main branch
- However, tagged commits can happen on any branch which would still run the tests/health check but since they happen in parallel, publishing might be successful even if these checks fail
- Merge docker-publish-staging and docker-publish-release into docker-publish
- docker-publish now depends on flake8, isort, black, django-check

.github/workflows/test.yml

@@ -1,6 +1,14 @@
 name: "CI"
 
-on: push
+# The workflow should be triggered on any push and release events.
+# Release events can push tags (triggering a push event).
+# Therefore:
+#  - docker-publish-staging – is only triggered on push events to main branch
+#  - docker-publish-release – is only triggered on release events
+on:
+  push:
+  release:
+    types: [ released ]
 
 jobs:
   flake8:
@@ -98,3 +106,55 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: coveralls --service=github
+
+  docker-publish:
+    if: |
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'release' && github.event.action == 'released')
+    needs: [ flake8, isort, black, django-check ]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+      - name: Set up Docker Buildx
+        uses: docker/[email protected]
+      - name: Cache Docker layers
+        uses: actions/[email protected]
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+      - name: Login to DockerHub
+        uses: docker/[email protected]
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Set tag (staging)
+        # Set "staging" as Docker tag if the event is a push to main branch
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: echo "DOCKER_TAG=staging" >> $GITHUB_ENV
+      - name: Set tag (release)
+        # Set the tag versions as Docker tag if it is a release event
+        if: github.event_name == 'release' && github.event.action == 'released'
+        run: echo "DOCKER_TAG=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+      - name: Build and push
+        id: docker_build
+        uses: docker/[email protected]
+        with:
+          context: .
+          push: true
+          # Target production image from multi-stage build (check Dockerfile)
+          target: production
+          tags: gnosispm/safe-config-service:${{ env.DOCKER_TAG }}
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new
+      - # Temp fix
+        # https://github.com/docker/build-push-action/issues/252
+        # https://github.com/moby/buildkit/issues/1896
+        name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+      - name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}