docker-build-push.yml

name: Build and Push Docker Images

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  workflow_dispatch:
    inputs:
      push_images:
        description: 'Push images to registry'
        required: false
        default: 'true'
        type: boolean

env:
  REGISTRY: ghcr.io
  NAMESPACE: smashingtags
  FRONTEND_IMAGE_NAME: homelabarr-frontend
  BACKEND_IMAGE_NAME: homelabarr-backend

permissions:
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
      with:
        token: ${{ secrets.GH_PAT }}

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
      
    - name: Log in to Docker Hub
      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4
      continue-on-error: true
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
      
    - name: Log in to Container Registry
      if: github.event_name != 'pull_request'
      run: |
        echo "${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin
    
    - name: Extract metadata for frontend
      id: meta-frontend
      uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6
      with:
        images: |
          ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}
          ${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr,prefix=pr-
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=raw,value=latest,enable={{is_default_branch}}
        labels: |
          org.opencontainers.image.title=HomelabARR Frontend
          org.opencontainers.image.description=React frontend for HomelabARR CE container management
          org.opencontainers.image.vendor=HomelabARR CE
          org.opencontainers.image.licenses=MIT

    - name: Extract metadata for backend
      id: meta-backend
      uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6
      with:
        images: |
          ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.BACKEND_IMAGE_NAME }}
          ${{ env.NAMESPACE }}/${{ env.BACKEND_IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr,prefix=pr-
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=raw,value=latest,enable={{is_default_branch}}
        labels: |
          org.opencontainers.image.title=HomelabARR Backend
          org.opencontainers.image.description=Node.js backend with CE Bridge for HomelabARR container management
          org.opencontainers.image.vendor=HomelabARR CE
          org.opencontainers.image.licenses=MIT
          
    - name: Build and push frontend image
      id: build-frontend
      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
      with:
        context: .
        file: ./Dockerfile
        platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
        push: ${{ github.event_name != 'pull_request' && (github.event.inputs.push_images != 'false') }}
        load: ${{ github.event_name == 'pull_request' }}
        tags: ${{ steps.meta-frontend.outputs.tags }}
        labels: ${{ steps.meta-frontend.outputs.labels }}
        cache-from: type=gha
        cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }}
        provenance: ${{ github.event_name != 'pull_request' }}
        sbom: ${{ github.event_name != 'pull_request' }}
        build-args: |
          NODE_ENV=production

    - name: Build and push backend image
      id: build-backend
      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
      with:
        context: .
        file: ./Dockerfile.backend
        platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
        push: ${{ github.event_name != 'pull_request' && (github.event.inputs.push_images != 'false') }}
        load: ${{ github.event_name == 'pull_request' }}
        tags: ${{ steps.meta-backend.outputs.tags }}
        labels: ${{ steps.meta-backend.outputs.labels }}
        cache-from: type=gha
        cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }}
        provenance: ${{ github.event_name != 'pull_request' }}
        sbom: ${{ github.event_name != 'pull_request' }}
        build-args: |
          NODE_ENV=production

    - name: Install cosign
      if: github.event_name != 'pull_request'
      uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac  # v3

    - name: Sign frontend image
      if: github.event_name != 'pull_request'
      env:
        COSIGN_EXPERIMENTAL: "1"
      run: cosign sign --yes ghcr.io/${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}@${{ steps.build-frontend.outputs.digest }}

    - name: Sign backend image
      if: github.event_name != 'pull_request'
      env:
        COSIGN_EXPERIMENTAL: "1"
      run: cosign sign --yes ghcr.io/${{ env.NAMESPACE }}/${{ env.BACKEND_IMAGE_NAME }}@${{ steps.build-backend.outputs.digest }}

    - name: Cosign verify freshly-pushed frontend
      if: github.event_name != 'pull_request'
      run: |
        cosign verify \
          --certificate-identity-regexp 'https://github.com/imogenlabs/homelabarr-ce/.github/workflows/' \
          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
          ghcr.io/${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}@${{ steps.build-frontend.outputs.digest }}

    - name: Cosign verify freshly-pushed backend
      if: github.event_name != 'pull_request'
      run: |
        cosign verify \
          --certificate-identity-regexp 'https://github.com/imogenlabs/homelabarr-ce/.github/workflows/' \
          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
          ghcr.io/${{ env.NAMESPACE }}/${{ env.BACKEND_IMAGE_NAME }}@${{ steps.build-backend.outputs.digest }}

    - name: Comment on PR if cosign verify failed
      if: failure() && github.event_name == 'pull_request'
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
      with:
        script: |
          await github.rest.issues.createComment({
            owner: context.repo.owner,
            repo: context.repo.repo,
            issue_number: context.issue.number,
            body: '**cosign verify failed** on the freshly-pushed image. See [PB-03](docs/ir/playbooks/PB-03-cosign-verify-fail.md) for incident response.',
          });

    - name: Trivy scan frontend
      if: github.event_name != 'pull_request'
      uses: aquasecurity/trivy-action@v0.36.0
      continue-on-error: true
      with:
        image-ref: ghcr.io/${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}@${{ steps.build-frontend.outputs.digest }}
        format: sarif
        output: trivy-frontend.sarif
        severity: CRITICAL,HIGH
        ignore-unfixed: true

    - name: Trivy scan backend
      if: github.event_name != 'pull_request'
      uses: aquasecurity/trivy-action@v0.36.0
      continue-on-error: true
      with:
        image-ref: ghcr.io/${{ env.NAMESPACE }}/${{ env.BACKEND_IMAGE_NAME }}@${{ steps.build-backend.outputs.digest }}
        format: sarif
        output: trivy-backend.sarif
        severity: CRITICAL,HIGH
        ignore-unfixed: true

    - name: Upload Trivy SARIF
      if: always() && github.event_name != 'pull_request'
      uses: github/codeql-action/upload-sarif@fee9466b8957867761f2d78f922ab084e3e2dd17  # v3
      with:
        sarif_file: trivy-backend.sarif
        category: trivy-image

    - name: Test image functionality
      if: github.event_name == 'pull_request'
      run: |
        echo "Testing frontend image..."
        docker run --rm --detach --name test-frontend --publish 18080:8080 \
          ${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}:pr-${{ github.event.number }}

        sleep 10
        curl -f http://localhost:18080/health || echo "Frontend health check failed (expected without backend)"
        docker stop test-frontend
        echo "Frontend image test completed"
        
    - name: Update deployment manifest
      if: github.ref == 'refs/heads/main'
      run: |
        # Update homelabarr.yml with latest image tags
        sed -i 's|ghcr.io/.*/homelabarr-frontend:.*|${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.FRONTEND_IMAGE_NAME }}:latest|g' homelabarr.yml
        sed -i 's|ghcr.io/.*/homelabarr-backend:.*|${{ env.REGISTRY }}/${{ env.NAMESPACE }}/${{ env.BACKEND_IMAGE_NAME }}:latest|g' homelabarr.yml
        
        echo "Updated deployment manifest with latest images"
        
    - name: Generate deployment summary
      if: github.event_name != 'pull_request'
      run: |
        echo "## 🐳 Docker Images Built and Pushed" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### Frontend Image" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
        echo "${{ steps.meta-frontend.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### Backend Image" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
        echo "${{ steps.meta-backend.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### 🚀 Deployment" >> $GITHUB_STEP_SUMMARY
        echo "Deploy using:" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
        echo "# Download deployment manifest" >> $GITHUB_STEP_SUMMARY
        echo "curl -o homelabarr.yml https://raw.githubusercontent.com/${{ github.repository }}/main/homelabarr.yml" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "# Configure environment" >> $GITHUB_STEP_SUMMARY
        echo "export CLI_BRIDGE_HOST_PATH=/path/to/your/homelabarr-cli" >> $GITHUB_STEP_SUMMARY
        echo "export DOCKER_GID=\$(getent group docker | cut -d: -f3)" >> $GITHUB_STEP_SUMMARY
        echo "export CORS_ORIGIN=https://your-domain.com" >> $GITHUB_STEP_SUMMARY
        echo "export JWT_SECRET=\$(openssl rand -base64 32)" >> $GITHUB_STEP_SUMMARY
        echo "export DEFAULT_ADMIN_PASSWORD=YourSecurePassword" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "# Deploy" >> $GITHUB_STEP_SUMMARY
        echo "docker-compose -f homelabarr.yml up -d" >> $GITHUB_STEP_SUMMARY
        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
    - name: Notify Discord (HomelabARR CE release)
      # Only send pretty Discord card for tagged releases (e.g. v1.2.3)
      if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
      env:
        DISCORD_WEBHOOK: ${{ secrets.DISCORD_RLS }}
      run: |
        if [ -z "${DISCORD_WEBHOOK}" ]; then
          echo "DISCORD_RLS not set; skipping Discord notification"
          exit 0
        fi

        TAG="${GITHUB_REF_NAME}"
        SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-7)"


        payload="{\"embeds\":[{\"title\":\"HomelabARR CE $TAG Released\",\"author\":{\"name\":\"Imogen Labs\"},\"color\":5814783,\"fields\":[{\"name\":\"Version\",\"value\":\"$TAG ($SHORT_SHA)\"},{\"name\":\"Changelog\",\"value\":\"[View on GitHub](https://github.com/smashingtags/homelabarr-ce/releases/tag/$TAG)\"},{\"name\":\"Docker\",\"value\":\"\`docker pull ghcr.io/smashingtags/homelabarr-frontend:$TAG\`\"}],\"footer\":{\"text\":\"GitHub Actions\"}}]}"

        curl -sS \
          -H "Content-Type: application/json" \
          -d "${payload}" \
          "${DISCORD_WEBHOOK}" || echo "Discord webhook failed"