cd.yml

name: cd

# Builds the dashboard container image from the root Dockerfile and publishes it to the GitHub
# Container Registry, modelled on wolfstar-project/.github's reusable-publish-image workflow:
# each platform builds natively on its own runner and pushes by digest, then one job merges the
# digests into a single multi-arch manifest list. The resulting image runs on Docker, Railway, or
# any other container platform (see the Dockerfile for the runtime contract).

on:
  push:
    branches:
      - main
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    name: 🐳 Build ${{ matrix.platform }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 30
    permissions:
      contents: read # checkout repository
      packages: write # push image layers to ghcr.io
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Prepare
        env:
          PLATFORM: ${{ matrix.platform }}
        run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # A tag builds the `release` channel only when it is exactly `v<version>` of the dashboard
      # package, so a stray or stale tag cannot publish an image that reports a different release.
      - name: Resolve build environment
        env:
          REF_TYPE: ${{ github.ref_type }}
          REF_NAME: ${{ github.ref_name }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          if [[ "$REF_TYPE" == "tag" ]]; then
            version="$(node --print "require('./apps/dashboard/package.json').version")"
            if [[ "$REF_NAME" != "v$version" ]]; then
              echo "::error::Tag $REF_NAME does not match apps/dashboard version v$version" >&2
              exit 1
            fi
            build_env=release
          elif [[ "$REF_NAME" == "$DEFAULT_BRANCH" ]]; then
            build_env=canary
          else
            build_env=preview
          fi
          echo "BUILD_ENV=$build_env" >> "$GITHUB_ENV"

      - name: Extract metadata (labels) for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            CODE_ZERO_BUILD_COMMIT=${{ github.sha }}
            CODE_ZERO_BUILD_BRANCH=${{ github.ref_name }}
            CODE_ZERO_BUILD_ENV=${{ env.BUILD_ENV }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          mkdir -p "$RUNNER_TEMP/digests"
          touch "$RUNNER_TEMP/digests/${DIGEST#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: 📦 Create and push manifest list
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    needs: build
    permissions:
      packages: write # push the manifest list to ghcr.io
    steps:
      - name: Download digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      # `latest` follows the default branch, so a Railway or Docker service pointed at
      # `ghcr.io/<owner>/<repo>:latest` tracks `main`; release tags add semver tags alongside.
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,format=long,prefix=

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        run: |
          # shellcheck disable=SC2046
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf "${IMAGE}@sha256:%s " *)

      - name: Inspect image
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          VERSION: ${{ steps.meta.outputs.version }}
        run: docker buildx imagetools inspect "${IMAGE}:${VERSION}"