publish.yml

# Builds, scans and pushes the images to GHCR after the CI gate; the server only pulls them.
name: Publish images

on:
  push:
    branches: [develop, master]
    tags: ['v[0-9]+.[0-9]+.[0-9]+']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE_PREFIX: ghcr.io/pkgdiff-dev/pkgdiff

jobs:
  gate:
    name: Gate
    uses: ./.github/workflows/ci.yml

  publish:
    name: Build, scan and push
    needs: gate
    # A manual run from another branch would push a tag named after it and write the shared build cache
    if: github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
    outputs:
      tag: ${{ steps.tags.outputs.primary }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Work out the tags
        id: tags
        run: |
          primary="sha-${GITHUB_SHA::7}"
          tags="$primary"
          case "$GITHUB_REF" in
            refs/heads/*)
              tags="$tags $(printf '%s' "$GITHUB_REF_NAME" | tr -c 'A-Za-z0-9_.-' '-')"
              ;;
            refs/tags/v*)
              version="${GITHUB_REF_NAME#v}"
              tags="$tags $version ${version%.*}"
              ;;
          esac
          echo "PRIMARY=$primary" >> "$GITHUB_ENV"
          echo "primary=$primary" >> "$GITHUB_OUTPUT"
          echo "TAGS=$tags" >> "$GITHUB_ENV"

      - name: Log in to GHCR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: printf '%s' "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin

      - name: Build
        run: |
          docker buildx create --name pkgdiff --driver docker-container --use
          created="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          # Rerun the OS upgrade layer on every build so same-day security fixes are included
          upgrade_key="$GITHUB_RUN_ID.$GITHUB_RUN_ATTEMPT"

          build() {
            docker buildx build "$2" \
              --tag "$IMAGE_PREFIX-$1:$PRIMARY" \
              --build-arg "$3=$upgrade_key" \
              --label "org.opencontainers.image.title=pkgdiff-$1" \
              --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
              --label "org.opencontainers.image.revision=$GITHUB_SHA" \
              --label "org.opencontainers.image.created=$created" \
              --cache-from "type=registry,ref=$IMAGE_PREFIX-$1:buildcache" \
              --cache-to "type=registry,ref=$IMAGE_PREFIX-$1:buildcache,mode=max" \
              --provenance=false --sbom=false \
              --load
          }

          build backend src/backend APT_UPGRADE_DATE
          build frontend src/frontend APK_UPGRADE_DATE

      - name: Start the frontend image in both roles
        run: |
          image="$IMAGE_PREFIX-frontend:$PRIMARY"
          docker run --rm --add-host backend:127.0.0.1 --entrypoint nginx "$image" -t
          docker run -d --name pkgdiff-ssr-check --user 65534:65534 --read-only --tmpfs /tmp \
            --cap-drop ALL -e PORT=4000 -e SSR_INTERNAL_ORIGIN=http://127.0.0.1:9 \
            --entrypoint node "$image" /app/server/server.mjs
          ready=""
          for attempt in $(seq 1 30); do
            if docker exec pkgdiff-ssr-check wget -q -O /dev/null http://127.0.0.1:4000/healthz; then ready=1; break; fi
            sleep 1
          done
          docker logs pkgdiff-ssr-check
          test -n "$ready"
          docker exec pkgdiff-ssr-check wget -q -O - http://127.0.0.1:4000/terms | grep -q 'ng-server-context="ssr"'
          docker rm -f pkgdiff-ssr-check

      - name: Scan the images
        run: |
          CHECK_DEPS_DOCKER=1 TRIVY=1 \
            BACKEND_IMAGE="$IMAGE_PREFIX-backend:$PRIMARY" \
            FRONTEND_IMAGE="$IMAGE_PREFIX-frontend:$PRIMARY" \
            bash .github/scripts/check-deps.sh

      - name: Push
        run: |
          for name in backend frontend; do
            for tag in $TAGS; do
              docker tag "$IMAGE_PREFIX-$name:$PRIMARY" "$IMAGE_PREFIX-$name:$tag"
              docker push "$IMAGE_PREFIX-$name:$tag"
            done
          done

      - name: Summary
        run: |
          {
            echo "### Published images"
            echo
            for name in backend frontend; do
              for tag in $TAGS; do
                echo "- \`$IMAGE_PREFIX-$name:$tag\`"
              done
            done
            echo
            echo "Deploy on the server: \`bash deploy/deploy.sh $PRIMARY\`"
          } >> "$GITHUB_STEP_SUMMARY"

  # A repository variable, so a release can be held back without editing this file
  deploy:
    name: Deploy
    needs: publish
    if: github.event_name == 'push' && github.ref == 'refs/heads/develop' && vars.PKGDIFF_AUTO_DEPLOY == 'true'
    permissions: {}
    uses: ./.github/workflows/deploy.yml
    with:
      action: deploy
      tag: ${{ needs.publish.outputs.tag }}
      revision: ${{ github.sha }}
    secrets: inherit