release.yml

name: Release (build & push images)

# Triggera solo su tag versione, es. `git tag v0.7.1 && git push --tags`.
# Pubblica 3 immagini multi-arch su GHCR:
#   ghcr.io/andreaprestia/accanto-backend:<tag>   (+ :latest)
#   ghcr.io/andreaprestia/accanto-frontend:<tag>  (+ :latest)
#   ghcr.io/andreaprestia/accanto-web:<tag>       (+ :latest)
#
# Per il sito vetrina (web) e la SPA (frontend), gli URL pubblici sono baked at build time.
# Configurali su GitHub → Settings → Secrets and variables → Actions → Variables:
#   WEB_SITE_URL          es. https://accanto.care
#   WEB_PUBLIC_APP_URL    es. https://app.accanto.care
#   WEB_API_BASE_URL      es. https://api.accanto.care (URL pubblico API per la SPA)
# Se assenti, vengono usati i default localhost (utili solo per smoke test).

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag da pubblicare (es. v0.7.1). Se vuoto, usa il nome del ref.'
        required: false

permissions:
  contents: write
  packages: write
  # Necessari per SLSA build provenance attestation firmata via Sigstore:
  #   - id-token:write -> OIDC token per Fulcio (cert ephemeral)
  #   - attestations:write -> pubblica l'attestation su GitHub (visibile
  #     nella tab Security > Attestations e via `gh attestation verify`)
  id-token: write
  attestations: write

env:
  REGISTRY: ghcr.io
  IMAGE_OWNER: ${{ github.repository_owner }}

jobs:
  build-and-push:
    name: Build & push ${{ matrix.image.name }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - name: backend
            context: .
            dockerfile: ./backend/Dockerfile
          - name: frontend
            context: ./frontend
            dockerfile: ./frontend/Dockerfile
          - name: web
            context: ./web
            dockerfile: ./web/Dockerfile

    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute tag
        id: tag
        run: |
          if [ -n "${{ github.event.inputs.tag }}" ]; then
            RAW="${{ github.event.inputs.tag }}"
          else
            RAW="${GITHUB_REF_NAME}"
          fi
          echo "value=${RAW}" >> "$GITHUB_OUTPUT"
          # version numerica (strip leading 'v') per /p:Version del backend .NET.
          echo "version=${RAW#v}" >> "$GITHUB_OUTPUT"

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/accanto-${{ matrix.image.name }}
          tags: |
            type=raw,value=${{ steps.tag.outputs.value }}
            type=raw,value=latest

      - name: Build & push
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.image.context }}
          file: ${{ matrix.image.dockerfile }}
          push: true
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APP_VERSION=${{ steps.tag.outputs.version }}
            VITE_API_BASE_URL=${{ vars.WEB_API_BASE_URL || '/api' }}
            SITE_URL=${{ vars.WEB_SITE_URL || 'http://localhost:4321' }}
            PUBLIC_APP_URL=${{ vars.WEB_PUBLIC_APP_URL || 'http://localhost:5173' }}
          cache-from: type=gha,scope=${{ matrix.image.name }}
          cache-to: type=gha,scope=${{ matrix.image.name }},mode=max
          # BuildKit attestations attaccate all'OCI manifest come referrers
          # nel registry (in-toto format). 'mode=max' include i Dockerfile +
          # i build args nelle SLSA provenance materials. 'sbom: true'
          # esegue syft dentro BuildKit -> SBOM SPDX embedded nell'immagine,
          # complementare alle CycloneDX generate post-build dal job
          # github-release (CycloneDX = release-level, SPDX = image-level).
          provenance: mode=max
          sbom: true

      # SLSA v1.0 build provenance firmata via Sigstore keyless (Fulcio +
      # Rekor). Diversa dalla provenance BuildKit di sopra: questa e'
      # firmata da GitHub con OIDC ed e' verificabile pubblicamente con
      # `gh attestation verify oci://ghcr.io/.../accanto-<img>:<tag>
      # --repo AndreaPrestia/Accanto`. Conferma che l'immagine e' stata
      # buildata da questa repo, in questo workflow, a partire da questo
      # commit (proteggge da tipo-squatting + dependency confusion sui
      # consumatori delle immagini).
      - name: SLSA build provenance attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/accanto-${{ matrix.image.name }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  github-release:
    name: Create GitHub Release
    needs: build-and-push
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET 10
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      # SBOM CycloneDX allegate alla release per audit/compliance.
      # Stessa logica del job 'sbom' in security.yml ma versionata
      # immutabilmente (asset di release, retention infinita).
      - name: Generate SBOMs
        run: |
          set -euo pipefail
          mkdir -p sbom
          TAG="${GITHUB_REF_NAME}"

          dotnet tool install --global CycloneDX
          # Aggiungi global tools al PATH.
          export PATH="$PATH:$HOME/.dotnet/tools"

          dotnet CycloneDX backend/src/Accanto.Api/Accanto.Api.csproj \
            --output-format Json --output sbom --filename "backend-${TAG}.cdx.json"

          npm install -g @cyclonedx/cyclonedx-npm

          (cd frontend && npm ci --ignore-scripts && \
            cyclonedx-npm --output-format JSON --spec-version 1.5 \
              --output-file "../sbom/frontend-${TAG}.cdx.json")
          (cd web && npm ci --ignore-scripts && \
            cyclonedx-npm --output-format JSON --spec-version 1.5 \
              --output-file "../sbom/web-${TAG}.cdx.json")

          # Sidecar SHA-256 per chain of custody dei file SBOM.
          (cd sbom && for f in *.cdx.json; do sha256sum "$f" > "$f.sha256"; done)
          ls -la sbom/

      - name: Create release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF_NAME}"
          # Skip se la release esiste già (es. ri-run manuale).
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "Release $TAG already exists, allegando SBOM..."
            gh release upload "$TAG" sbom/*.cdx.json sbom/*.sha256 --clobber
            exit 0
          fi
          gh release create "$TAG" \
            --title "$TAG" \
            --generate-notes \
            sbom/*.cdx.json sbom/*.sha256