docker.yml

name: Build and Push Docker Image

on:
  pull_request:
  push:
    branches:
      - "main"

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  # vars.* are not exposed to fork-PR runs on public repos, so fallbacks
  # keep the image tag valid for the local build + smoke test.
  REGISTRY: ${{ vars.DOCKER_REGISTRY || 'localhost' }}
  PROJECT: ${{ vars.DOCKER_PROJECT || 'fork-pr' }}
  IMAGE_NAME: nebi

jobs:
  build:
    name: Build (${{ matrix.platform }})
    strategy:
      fail-fast: false
      matrix:
        include:
          # Each platform builds, smoke-tests, and scans natively on its own
          # runner (#417): no QEMU emulation, no cross-compilation.
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      # linux/amd64 -> linux-amd64, used in cache scopes and artifact names
      - name: Prepare platform slug
        env:
          PLATFORM: ${{ matrix.platform }}
        run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Compute version
        id: version
        # git describe matches the format internal/api/handlers/version.go parses
        # (e.g. v0.12-rc3-4-ge8f6759 -> 0.12-rc3.dev+e8f6759). fetch-depth: 0 above
        # makes tags available. Without this the image bakes VERSION=dev and the
        # UI shows "vdev".
        run: echo "version=$(git describe --tags --always --dirty)" >> "$GITHUB_OUTPUT"

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        env:
          DOCKER_METADATA_PR_HEAD_SHA: true
        with:
          images: ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}
          tags: |
            # PR builds: tag with pr-<number> and sha only
            type=ref,event=pr
            type=sha
            # Main branch builds: add branch name and latest
            type=ref,event=branch,enable={{is_default_branch}}
            type=raw,value=latest,enable={{is_default_branch}}
            # Release builds
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      - name: Determine registry publishing
        id: registry
        shell: bash
        env:
          DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
          DOCKER_REGISTRY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
        run: |
          PUBLISH=false
          if [[ '${{ github.event_name }}' != 'pull_request' ]]; then
            PUBLISH=true
          elif [[ -n "${DOCKER_REGISTRY_USERNAME}" && -n "${DOCKER_REGISTRY_PASSWORD}" ]]; then
            PUBLISH=true
          fi

          echo "publish=${PUBLISH}" | tee --append "${GITHUB_OUTPUT}"

      - name: Login to Quay.io
        if: steps.registry.outputs.publish == 'true'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}

      # Build locally only; the digest push happens in a later step so the
      # smoke test and vulnerability scan gate what gets published.
      - name: Build image
        id: build
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          build-args: |
            VERSION=${{ steps.version.outputs.version }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ matrix.platform }}
          push: false
          load: true
          cache-from: ${{ steps.registry.outputs.publish == 'true' && format('type=gha,scope={0}', env.PLATFORM_PAIR) || '' }}
          cache-to: ${{ steps.registry.outputs.publish == 'true' && format('type=gha,mode=max,scope={0}', env.PLATFORM_PAIR) || '' }}

      - name: Smoke test
        run: |
          IMAGE_TAG="${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}"
          echo "Testing image: ${IMAGE_TAG}"

          # Start container with port mapping
          docker run --rm -d --name test-nebi \
            -p 8460:8460 \
            -e NEBI_AUTH_JWT_SECRET=test-secret-that-is-at-least-32-chars-long \
            -e NEBI_DATABASE_DSN=/tmp/test.db \
            ${IMAGE_TAG}

          # Wait for startup
          sleep 10

          # Check if container is still running
          docker ps | grep test-nebi

          # Check logs
          docker logs test-nebi

          # Test health endpoint from host (pixi image has no wget/curl)
          curl -sf http://localhost:8460/api/v1/health || exit 1

          # Guard: the image must report a real version, not the "dev" default.
          # Catches a dropped VERSION build-arg (the bug that made the UI show "vdev").
          VERSION_JSON=$(curl -sf http://localhost:8460/api/v1/version)
          echo "Version endpoint: ${VERSION_JSON}"
          REPORTED=$(echo "${VERSION_JSON}" | python3 -c 'import sys,json; print(json.load(sys.stdin)["version"])')
          echo "Reported version: ${REPORTED}"
          if [ "${REPORTED}" = "dev" ] || [ -z "${REPORTED}" ]; then
            echo "ERROR: image reports version '${REPORTED}' — VERSION build-arg was not injected"
            exit 1
          fi

          # Cleanup
          docker stop test-nebi

      # Scan the locally built image (base layers + compiled binary) and fail
      # on fixable High/Critical findings (#451). Runs before the push step so
      # an image that fails the scan is never published.
      - name: Scan image for vulnerabilities
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          format: table
          exit-code: '1'
          severity: CRITICAL,HIGH
          ignore-unfixed: true

      # Push the image that passed the smoke test and scan, addressed by
      # digest only (no tags yet). Rebuilds from this runner's BuildKit cache,
      # so the pushed layers are the ones that were tested. The merge job
      # stitches the per-platform digests into one tagged manifest list.
      - name: Push image by digest
        id: push
        if: steps.registry.outputs.publish == 'true'
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          file: ./Dockerfile
          build-args: |
            VERSION=${{ steps.version.outputs.version }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}

      - name: Export digest
        if: steps.registry.outputs.publish == 'true'
        run: |
          mkdir -p "${{ runner.temp }}/digests"
          digest='${{ steps.push.outputs.digest }}'
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        if: steps.registry.outputs.publish == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  # Combine the per-platform digests pushed above into a single manifest
  # list carrying the real tags. Runs only if every platform passed its
  # smoke test and scan.
  merge:
    name: Push manifest list
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Determine registry publishing
        id: registry
        shell: bash
        env:
          DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
          DOCKER_REGISTRY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
        run: |
          PUBLISH=false
          if [[ '${{ github.event_name }}' != 'pull_request' ]]; then
            PUBLISH=true
          elif [[ -n "${DOCKER_REGISTRY_USERNAME}" && -n "${DOCKER_REGISTRY_PASSWORD}" ]]; then
            PUBLISH=true
          fi

          echo "publish=${PUBLISH}" | tee --append "${GITHUB_OUTPUT}"

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        env:
          DOCKER_METADATA_PR_HEAD_SHA: true
        with:
          images: ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}
          tags: |
            # PR builds: tag with pr-<number> and sha only
            type=ref,event=pr
            type=sha
            # Main branch builds: add branch name and latest
            type=ref,event=branch,enable={{is_default_branch}}
            type=raw,value=latest,enable={{is_default_branch}}
            # Release builds
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}

      - name: Download digests
        if: steps.registry.outputs.publish == 'true'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        if: steps.registry.outputs.publish == 'true'
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Login to Quay.io
        if: steps.registry.outputs.publish == 'true'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}

      - name: Create and push manifest list
        if: steps.registry.outputs.publish == 'true'
        working-directory: ${{ runner.temp }}/digests
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          IMAGE: ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}
        run: |
          TAG_ARGS=()
          while IFS= read -r tag; do
            [ -z "${tag}" ] && continue
            TAG_ARGS+=(-t "${tag}")
          done <<< "${TAGS}"

          REFS=()
          for digest in *; do
            REFS+=("${IMAGE}@sha256:${digest}")
          done

          docker buildx imagetools create "${TAG_ARGS[@]}" "${REFS[@]}"

      - name: Inspect manifest list
        if: steps.registry.outputs.publish == 'true'
        run: |
          docker buildx imagetools inspect \
            '${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}'

      - name: Add image tags to summary
        run: |
          echo "## Docker Image Built: ${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [[ '${{ steps.registry.outputs.publish }}' == 'true' ]]; then
            echo "**Platforms:** linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY
          else
            echo "**Platforms:** linux/amd64, linux/arm64 (local build only, not published)" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Pull Command:" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "docker pull ${{ env.REGISTRY }}/${{ env.PROJECT }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### All Tags:" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.meta.outputs.tags }}" | sed 's/,/\n/g' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY