From 0a20a4741f22bcbe7f70d649e553d8fc11c060c2 Mon Sep 17 00:00:00 2001
From: Thomas Sibley <tsibley@fredhutch.org>
Date: Tue, 9 May 2023 15:52:29 -0700
Subject: [PATCH] ci: Test pathogen repo CI builds using images on docker.io
 instead of ghcr.io
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This should fix the currently-broken test-pathogen-repo-ci jobs when our
CI runs on master² (and they should continue to work on branches too).
It requires a little rearranging of jobs in the workflow, with a little
additional and unfortunate complexity due to conditionals.

This works around a Nextstrain CLI bug with registries other than
docker.io¹ during `nextstrain update docker` (and `nextstrain setup
docker`), which is run as part of our setup-nextstrain-cli action used
by this workflow.  Ideally we'll fix that bug and then be able to revert
this, especially since we might actually want to condition the pushing
to docker.io on the outcome of these test jobs in the future.

¹ <https://github.com/nextstrain/cli/issues/279>
² <https://github.com/nextstrain/docker-base/pull/148#issuecomment-1539203279>
---
 .github/workflows/ci.yml | 55 ++++++++++++++++++++++------------------
 1 file changed, 31 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5dc133d9..48840e31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,30 +82,6 @@ jobs:
       env:
         DOCKER_DEFAULT_PLATFORM: ${{ matrix.platform }}
 
-  # Run pathogen repo CI builds with the final image
-  test-pathogen-repo-ci:
-    needs: build
-    strategy:
-      # XXX TODO: Test on multiple platforms via the matrix too, as above?
-      matrix:
-        include:
-          - { pathogen: avian-flu,       build-args: auspice/flu_avian_h5n1_ha.json }
-          - { pathogen: ebola }
-          - { pathogen: lassa }
-          - { pathogen: monkeypox }
-          - { pathogen: mumps }
-          - { pathogen: ncov,            build-args: all_regions -j 2 --profile nextstrain_profiles/nextstrain-ci }
-          - { pathogen: seasonal-flu,    build-args: --configfile profiles/ci/builds.yaml -p }
-          - { pathogen: zika }
-    name: test-pathogen-repo-ci (${{ matrix.pathogen }})
-    uses: nextstrain/.github/.github/workflows/pathogen-repo-ci.yaml@master
-    with:
-      repo: nextstrain/${{ matrix.pathogen }}
-      build-args: ${{ matrix.build-args }}
-      env: |
-        NEXTSTRAIN_DOCKER_IMAGE: ghcr.io/nextstrain/base:${{ needs.build.outputs.tag }}
-      continue-on-error: true
-
   validate-platforms:
     name: Validate platforms
     needs: build
@@ -173,6 +149,37 @@ jobs:
       run: |
         ./devel/copy-images -i ghcr.io -o docker.io -t ${{ needs.build.outputs.tag }} -l
 
+  # Run pathogen repo CI builds with the final image
+  test-pathogen-repo-ci:
+    # Only one of push-{branch,build} runs for any given workflow run, and
+    # we're ok with either of them.
+    needs: [build, push-branch, push-build]
+    if: |2
+         success()
+      || needs.push-branch.result == 'success'
+      || needs.push-build.result == 'success'
+    strategy:
+      # XXX TODO: Test on multiple platforms via the matrix too, as above?
+      matrix:
+        include:
+          - { pathogen: avian-flu,       build-args: auspice/flu_avian_h5n1_ha.json }
+          - { pathogen: ebola }
+          - { pathogen: lassa }
+          - { pathogen: monkeypox }
+          - { pathogen: mumps }
+          - { pathogen: ncov,            build-args: all_regions -j 2 --profile nextstrain_profiles/nextstrain-ci }
+          - { pathogen: seasonal-flu,    build-args: --configfile profiles/ci/builds.yaml -p }
+          - { pathogen: zika }
+    name: test-pathogen-repo-ci (${{ matrix.pathogen }})
+    uses: nextstrain/.github/.github/workflows/pathogen-repo-ci.yaml@master
+    with:
+      repo: nextstrain/${{ matrix.pathogen }}
+      build-args: ${{ matrix.build-args }}
+      env: |
+        NEXTSTRAIN_DOCKER_IMAGE: nextstrain/base:${{ needs.build.outputs.tag }}
+      continue-on-error: true
+    secrets: inherit
+
   # Delete the builder and final images from GitHub Container Registry.
   cleanup-registry:
     if: always()