build-image.yml

name: Build and publish image

# Builds the production (bewelcome_php) image once in CI for both linux/amd64 and
# linux/arm64, pushes a multi-arch manifest to GHCR with immutable tags, scans the
# image with Trivy, and — only when the parallel CI workflow also passes — notifies
# BeWelcome/sysadmins-infra to deploy. The deploy server then only runs
# `docker compose pull && up -d` — no on-server build.
#
# Each architecture is built on a native runner (no QEMU emulation) and pushed
# by digest; a final job stitches the per-arch digests into one manifest list so
# `docker pull` resolves the right arch automatically.

on:
  push:
    branches: [develop]
    # Only rebuild when something that ends up in the image actually changes.
    paths:
      - 'Dockerfile'
      - '.dockerignore'
      - 'docker/**'
      - 'composer.json'
      - 'composer.lock'
      - 'symfony.lock'
      - 'package.json'
      - 'bun.lock'
      - 'webpack.config.js'
      - 'tailwind.config.js'
      - 'postcss.config.js'
      - 'src/**'
      - 'assets/**'
      - 'config/**'
      - 'templates/**'
      - 'public/**'
      - 'bin/**'
      - 'bootstrap/**'
      - 'routes.php'
      - '.github/workflows/build-image.yml'
    tags:
      - 'v*'
  workflow_dispatch: {}

permissions:
  contents: read
  packages: write
  actions: read

env:
  IMAGE: ghcr.io/bewelcome/rox

# Serialize per-ref so rapid develop pushes don't race two builds and fire two
# competing deploy dispatches; the newer push wins.
concurrency:
  group: build-image-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build ${{ matrix.arch }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
            runner: ubuntu-latest
          - arch: arm64
            platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # tag=v4.2.2

      - name: Compute version metadata
        id: version
        run: |
          echo "revision=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
          echo "timestamp=$(git log -n 1 --format=%ct)" >> "$GITHUB_OUTPUT"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # tag=v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96  # tag=v5.6.1
        with:
          images: ${{ env.IMAGE }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5  # tag=v3.8.0

      # Build the single-arch image and push it by digest only (no tags yet);
      # the merge job assembles the tagged multi-arch manifest from these digests.
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75  # tag=v6.9.0
        with:
          context: .
          target: bewelcome_php
          platforms: ${{ matrix.platform }}
          build-args: |
            APP_VERSION=${{ steps.version.outputs.revision }}
            APP_VERSION_TIMESTAMP=${{ steps.version.outputs.timestamp }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # tag=v4.6.2
        with:
          name: digests-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    name: Push manifest
    runs-on: ubuntu-latest
    needs: [build]
    outputs:
      short_sha: ${{ steps.vars.outputs.short_sha }}
      digest: ${{ steps.manifest.outputs.digest }}
    steps:
      - name: Download digests
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # tag=v4.1.8
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # tag=v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5  # tag=v3.8.0

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96  # tag=v5.6.1
        with:
          images: ${{ env.IMAGE }}
          tags: |
            type=sha,prefix=sha-
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

      - name: Create and push multi-arch manifest
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.IMAGE }}@sha256:%s ' *)

      # The recomputed 7-char short sha MUST match docker/metadata-action's
      # `type=sha` output (default short format = 7 chars). If anyone switches
      # metadata-action to `format=long`, the `imagetools inspect :sha-<shortsha>`
      # lookup below (and the deploy payload tag) will no longer match the pushed
      # tag and must be updated accordingly.
      - name: Compute short sha
        id: vars
        run: echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      # Resolve the immutable digest of the freshly pushed manifest list so the
      # deploy payload (and rollback) pins an exact, arch-agnostic reference.
      - name: Capture manifest digest
        id: manifest
        run: |
          digest=$(docker buildx imagetools inspect "${{ env.IMAGE }}:sha-${{ steps.vars.outputs.short_sha }}" --format '{{json .Manifest.Digest}}' | tr -d '"')
          echo "digest=$digest" >> "$GITHUB_OUTPUT"

  scan:
    name: Scan image
    runs-on: ubuntu-latest
    needs: [merge]
    steps:
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # tag=v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # tag=v0.36.0
        env:
          TRIVY_DISABLE_VEX_NOTICE: '1'
        with:
          image-ref: ${{ env.IMAGE }}:sha-${{ needs.merge.outputs.short_sha }}
          format: table
          severity: CRITICAL,HIGH,MEDIUM
          exit-code: '1'
          ignore-unfixed: true

  deploy:
    name: Deploy to stage
    runs-on: ubuntu-latest
    needs: [merge, scan]
    if: >
      github.event_name == 'push' &&
      github.ref == 'refs/heads/develop' &&
      needs.merge.result == 'success' &&
      needs.scan.result == 'success'
    steps:
      - name: Wait for CI workflow on this commit
        # Poll ci.yml on this SHA only (not every GitHub check on the commit).
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # tag=v7.0.1
        with:
          script: |
            const { owner, repo } = context.repo;
            const sha = context.sha;
            const pollIntervalMs = 15_000;
            const maxAttempts = 40;

            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
              const { data } = await github.rest.actions.listWorkflowRuns({
                owner,
                repo,
                workflow_id: 'ci.yml',
                head_sha: sha,
                per_page: 1,
              });

              const run = data.workflow_runs[0];
              if (!run) {
                core.info(`CI workflow not started yet (attempt ${attempt}/${maxAttempts})`);
                await sleep(pollIntervalMs);
                continue;
              }

              core.info(`CI workflow ${run.html_url} status=${run.status} conclusion=${run.conclusion ?? 'pending'}`);

              if (run.status !== 'completed') {
                await sleep(pollIntervalMs);
                continue;
              }

              if (run.conclusion !== 'success') {
                core.setFailed(`CI workflow finished with conclusion "${run.conclusion}" — stage deploy blocked`);
                return;
              }

              core.info('CI workflow passed');
              return;
            }

            core.setFailed('Timed out waiting for CI workflow to complete');

      # Mint a short-lived installation token for the bewelcome-platform-deployer
      # GitHub App (installed on sysadmins-infra) to authenticate the cross-repo
      # dispatch, scoped to just that repo.
      - name: Mint cross-repo token
        id: app-token
        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69  # tag=v1.11.0
        with:
          app-id: ${{ secrets.DEPLOY_APP_ID }}
          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
          owner: BeWelcome
          repositories: sysadmins-infra

      # Trigger the stage deploy only for develop pushes. Tag (v*) builds publish
      # SemVer images but are deployed manually/gated from sysadmins-infra.
      - name: Notify sysadmins-infra to deploy stage
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0  # tag=v3.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          repository: BeWelcome/sysadmins-infra
          event-type: rox-image-pushed
          client-payload: |
            {
              "image": "${{ env.IMAGE }}:sha-${{ needs.merge.outputs.short_sha }}@${{ needs.merge.outputs.digest }}",
              "tag": "sha-${{ needs.merge.outputs.short_sha }}",
              "sha": "${{ github.sha }}",
              "ref": "${{ github.ref }}",
              "environment": "stage"
            }