synapse-module.yml

name: Test and build Synapse Guest Module

on:
    push:
        branches:
            - main
    pull_request:

jobs:
    build-py:
        name: Build Python
        runs-on: ubuntu-latest
        timeout-minutes: 15
        defaults:
            run:
                working-directory: ./modules/restricted-guests/synapse/
        env:
            DOCKER_IMAGE: ghcr.io/element-hq/synapse-guest-module
        steps:
            - uses: actions/checkout@v4

            - uses: actions/setup-python@v5
              with:
                  python-version: "3.11"

            - run: python -m pip install tox

            - name: lint
              run: tox -e check_codestyle

            - name: type checking and declarations
              run: tox -e check_types

            - name: Login to ghcr.io
              uses: docker/login-action@v3
              with:
                  registry: ghcr.io
                  username: ${{ github.repository_owner }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Generate Docker metadata
              id: meta
              uses: docker/metadata-action@v5
              env:
                  DOCKER_METADATA_PR_HEAD_SHA: true
              with:
                  images: ${{ env.DOCKER_IMAGE }}
                  labels: |
                      org.opencontainers.image.title=Synapse Guest Module
                      org.opencontainers.image.description=A synapse module to restrict the actions of guests
                      org.opencontainers.image.vendor=New Vector Ltd.
                  tags: |
                      type=sha,prefix=

            - name: Docker build and push
              uses: docker/build-push-action@v6
              id: dockerBuild
              with:
                  push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'pull_request' && secrets.GH_APP_OS_APP_ID != '' }}
                  context: modules/restricted-guests/synapse
                  tags: ${{ steps.meta.outputs.tags }}
                  labels: ${{ steps.meta.outputs.labels }}
                  platforms: linux/amd64,linux/arm64,linux/s390x
                  sbom: true
                  provenance: true