ci-nodejs-container.yml

name: Build and deploy node container image

on:
    workflow_dispatch:
    # paths mirror the changes job's dorny filter, which still gates push events.
    pull_request:
        paths:
            - 'nodejs/**'
            - 'common/hogvm/typescript/**'
            - 'common/plugin_transpiler/**'
            - 'common/esbuilder/**'
            - 'common/replay-shared/**'
            - 'common/replay-headless/**'
            - 'rust/common/hogvm/**'
            - 'rust/replay-anonymizer/**'
            - 'rust/replay-anonymizer-node/**'
            - 'Dockerfile.node'
            - '.github/workflows/ci-nodejs-container.yml'
            - 'turbo.json'
            - 'package.json'
            - 'pnpm-lock.yaml'
            - 'pnpm-workspace.yaml'
    push:
        branches:
            - 'master'

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
    cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
    changes:
        runs-on: ubuntu-24.04
        permissions:
            contents: read
            pull-requests: read
        timeout-minutes: 5
        # Skipped on trunk-merge/** branches: merge-queue PRs are ephemeral, nothing
        # pulls images pushed for them, and each constituent PR already built its own.
        if: github.repository_owner == 'PostHog' && !startsWith(github.head_ref, 'trunk-merge/')
        name: Determine need to run node Docker build
        outputs:
            node_files: ${{ steps.filter.outputs.node_files }}
        steps:
            - name: Check out
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  sparse-checkout: .github/actions/paths-filter
                  sparse-checkout-cone-mode: false

            - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              id: app-token
              if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
              with:
                  client-id: ${{ vars.GH_APP_POSTHOG_PATHS_FILTER_APP_ID }}
                  private-key: ${{ secrets.GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY }}
            - uses: ./.github/actions/paths-filter
              id: filter
              with:
                  token: ${{ steps.app-token.outputs.token || github.token }}
                  # Keep in sync with the trigger-level pull_request paths above.
                  filters: |
                      node_files:
                        - 'nodejs/**'
                        - 'common/hogvm/typescript/**'
                        - 'common/plugin_transpiler/**'
                        - 'common/esbuilder/**'
                        - 'common/replay-shared/**'
                        - 'common/replay-headless/**'
                        - 'rust/common/hogvm/**'
                        - 'rust/replay-anonymizer/**'
                        - 'rust/replay-anonymizer-node/**'
                        - 'Dockerfile.node'
                        - '.github/workflows/ci-nodejs-container.yml'
                        - 'turbo.json'
                        - 'package.json'
                        - 'pnpm-lock.yaml'
                        - 'pnpm-workspace.yaml'

    build:
        needs: changes
        name: Build and push node image
        if: |
            (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.changes.outputs.node_files == 'true') ||
            (github.event_name == 'push' && github.ref == 'refs/heads/master' && needs.changes.outputs.node_files == 'true' && github.repository_owner == 'PostHog' && vars.CD_DEPLOY_ENABLED == 'true')
        runs-on: depot-ubuntu-24.04
        timeout-minutes: 30
        permissions:
            id-token: write # allow issuing OIDC tokens for this workflow run
            contents: read # allow reading the repo contents
            packages: write # allow push to ghcr.io

        # ECR routing resolved once here so the push target (docker-meta) and the
        # digest pull target read the same value and can't drift: master → posthog-node
        # via the master role; everything else → posthog-node-prs via the prs role.
        env:
            ECR_IMAGE: ${{ github.ref == 'refs/heads/master' && 'posthog-node' || 'posthog-node-prs' }}
            ECR_ROLE: ${{ github.ref == 'refs/heads/master' && vars.AWS_ECR_POSTHOG_MASTER_PUBLISH_IAM_ROLE || vars.AWS_ECR_POSTHOG_PRS_PUBLISH_IAM_ROLE }}

        steps:
            # Fail loudly rather than let the role ternary silently fall back to the PRS
            # role if the master var is unset on master (which would push the prod repo
            # with a role that can't, giving a confusing access-denied).
            - name: Assert master publish role is configured
              if: github.ref == 'refs/heads/master'
              env:
                  MASTER_ROLE: ${{ vars.AWS_ECR_POSTHOG_MASTER_PUBLISH_IAM_ROLE }}
              run: |
                  if [[ -z "$MASTER_ROLE" ]]; then
                    echo "::error::AWS_ECR_POSTHOG_MASTER_PUBLISH_IAM_ROLE is not set — refusing to fall back to the PRS role on master."
                    exit 1
                  fi

            - name: Check out
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

            - name: Set up QEMU
              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

            - name: Set up Depot CLI
              uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1

            - name: Docker meta and registry login
              id: docker-meta
              uses: ./.github/actions/docker-meta
              with:
                  image-name: posthog-node
                  # ECR repo + role resolved once at job level (see env above). ghcr/dockerhub unchanged.
                  ecr-image-name: ${{ env.ECR_IMAGE }}
                  aws-role-to-assume: ${{ env.ECR_ROLE }}
                  github-token: ${{ secrets.GITHUB_TOKEN }}
                  dockerhub-username: ${{ secrets.DOCKERHUB_USER }}
                  dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
                  # Prod deploys from private ECR; pause the public ghcr push during an embargo.
                  push-to-ghcr: ${{ vars.PUBLIC_IMAGE_PUSH_PAUSED != 'true' }}

            - name: Build and push container image
              id: build
              uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
              with:
                  context: .
                  buildx-fallback: false
                  project: '00mrvlsdvh'
                  push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
                  file: Dockerfile.node
                  tags: ${{ steps.docker-meta.outputs.tags }}
                  labels: ${{ steps.docker-meta.outputs.labels }}
                  annotations: ${{ steps.docker-meta.outputs.annotations }}
                  platforms: linux/arm64,linux/amd64
                  build-args: |
                      COMMIT_HASH=${{ github.sha }}

            - name: Container image digest
              env:
                  IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
                  IMAGE_REGISTRY: ${{ steps.docker-meta.outputs.ecr-registry }}
              run: |
                  echo "Image digest: $IMAGE_DIGEST"
                  echo "Full image reference: $IMAGE_REGISTRY/$ECR_IMAGE:${{ github.sha }}@$IMAGE_DIGEST"
                  echo "## Container image built :rocket:" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "**Image reference:** \`$IMAGE_REGISTRY/$ECR_IMAGE:${{ github.sha }}@$IMAGE_DIGEST\`" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "**Image SHA:** \`${{ github.sha }}@$IMAGE_DIGEST\`" >> $GITHUB_STEP_SUMMARY
                  echo "" >> $GITHUB_STEP_SUMMARY
                  echo "- Commit: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
                  echo "- Digest: \`$IMAGE_DIGEST\`" >> $GITHUB_STEP_SUMMARY

            - name: Report failure
              if: failure()
              uses: PostHog/posthog-github-action@58dea254b598fb5d469c0699c98af8288a7f7650 # v1.2.0
              with:
                  posthog-token: ${{ secrets.POSTHOG_API_TOKEN }}
                  event: 'node-image-build'
                  properties: '{"status": "failure", "commit_hash": "${{ github.sha }}"}'
            - name: Report failure to DevEx PostHog
              if: failure()
              continue-on-error: true
              uses: PostHog/posthog-github-action@58dea254b598fb5d469c0699c98af8288a7f7650 # v1.2.0
              with:
                  posthog-token: ${{ secrets.POSTHOG_DEVEX_PROJECT_API_TOKEN }}
                  event: 'node-image-build'
                  properties: '{"status": "failure", "commit_hash": "${{ github.sha }}"}'

            - name: Get deployer token
              if: github.ref == 'refs/heads/master' && github.event_name == 'push' && vars.CD_DEPLOY_ENABLED == 'true'
              id: deployer
              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
              with:
                  client-id: ${{ secrets.GH_APP_CHARTS_DEPLOYER_APP_ID }}
                  private-key: ${{ secrets.GH_APP_CHARTS_DEPLOYER_PRIVATE_KEY }}
                  owner: PostHog
                  repositories: charts

            - name: Get PR labels
              if: github.ref == 'refs/heads/master' && github.event_name == 'push' && vars.CD_DEPLOY_ENABLED == 'true'
              id: labels
              uses: ./.github/actions/get-pr-labels
              with:
                  token: ${{ secrets.GITHUB_TOKEN }}

            - name: Trigger node deployment
              if: github.ref == 'refs/heads/master' && github.event_name == 'push' && vars.CD_DEPLOY_ENABLED == 'true'
              uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
              with:
                  token: ${{ steps.deployer.outputs.token }}
                  repository: PostHog/charts
                  event-type: commit_state_update
                  client-payload: |
                      {
                        "values": {
                          "image": {
                            "sha": "${{ github.sha }}@${{ steps.build.outputs.digest }}"
                          }
                        },
                        "release": "node",
                        "commit": ${{ toJson(github.event.head_commit) }},
                        "repository": ${{ toJson(github.repository) }},
                        "labels": ${{ steps.labels.outputs.labels }},
                        "timestamp": "${{ github.event.head_commit.timestamp }}"
                      }