docker.yml

name: Docker Images

env:
  DOCKER_METADATA_SHORT_SHA_LENGTH: 12

# Three trigger paths:
#
#   push to main            → build only apps with changed source (changes to
#                             packages/cloud/**, Dockerfile, bun.lock, bunfig.toml, styles.css
#                             or this workflow file fan out to ALL apps).
#                             Pushes :sha-<short> and :main.
#   tag cloud-<image>-v*    → build only that image (e.g. cloud-app-notebooks-v0.1.2).
#                             Pushes :v0.1.2 and :latest.
#   workflow_dispatch       → build everything on demand.
#
# Pulse is intentionally skipped because it is not release-ready yet. Everything
# else in the workspace ships. The expeditions app moved out to the cloud-template
# repo as the standalone reference app.

on:
  push:
    branches: [main]
    tags:
      - "cloud-*-v*"
  workflow_dispatch:

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: true

jobs:
  matrix:
    runs-on: ubuntu-latest
    outputs:
      apps: ${{ steps.set.outputs.apps }}
      complete_set: ${{ steps.set.outputs.complete_set }}
      release_tag: ${{ steps.set.outputs.release_tag }}
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          fetch-depth: 0

      - id: set
        env:
          REF: ${{ github.ref }}
          EVENT: ${{ github.event_name }}
          BEFORE: ${{ github.event.before }}
        run: |
          set -euo pipefail

          # Single source of truth for which apps produce a docker image.
          ALL='["gateway","core","accounts","api-docs","assistant","capabilities","contacts","dashboard","faq","files","gateway-ops","grids","ipa-hosts","kit","mail","notebooks","oauth","proxy-auth","quotes","spaces","tools","venue","weather"]'

          if [[ "$REF" == refs/tags/cloud-*-v* ]]; then
            # Tag form: cloud-<image>-v<version>. Strip prefix + version to
            # get the image, then drop optional "app-" to get the APP_ID.
            # Reject tags that don't map to one of the buildable apps.
            tag="${REF#refs/tags/}"
            image="${tag%-v*}"        # cloud-app-notebooks
            image="${image#cloud-}"   # app-notebooks
            id="${image#app-}"        # notebooks
            if ! jq -e --arg id "$id" 'index($id)' <<<"$ALL" >/dev/null; then
              echo "Tag $tag references unknown or skipped app: $id" >&2
              exit 1
            fi
            apps="[\"$id\"]"
            release_tag="${tag##*-}"
          elif [[ "$EVENT" == "workflow_dispatch" ]]; then
            apps="$ALL"
            release_tag="sha-${GITHUB_SHA:0:12}"
          else
            # Push to main: detect what changed since the previous push.
            base="$BEFORE"
            if [[ -z "$base" || "$base" == "0000000000000000000000000000000000000000" ]]; then
              base="HEAD~1"
            fi
            changed=$(git diff --name-only "$base" HEAD || git diff --name-only HEAD~1 HEAD)

            if echo "$changed" | grep -qE '^(packages/cloud/|patches/|Dockerfile|\.dockerignore|bun\.lock|bunfig\.toml|package\.json|styles\.css|\.github/workflows/docker\.yml)'; then
              apps="$ALL"
            else
              # Match packages/<id>/, intersect with ALL (drops pulse).
              touched=$(echo "$changed" | sed -nE 's|^packages/([^/]+)/.*|\1|p' | sort -u)
              apps=$(jq -nc --argjson all "$ALL" --arg list "$touched" \
                '[$list | split("\n")[] | select(length > 0)] as $t | $all | map(select(. as $a | $t | index($a)))')
            fi
            release_tag="sha-${GITHUB_SHA:0:12}"
          fi

          complete_set=false
          if [[ "$(jq -c . <<<"$apps")" == "$(jq -c . <<<"$ALL")" ]]; then
            complete_set=true
          fi

          echo "apps=$apps" >> "$GITHUB_OUTPUT"
          echo "complete_set=$complete_set" >> "$GITHUB_OUTPUT"
          echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"
          echo "Matrix: $apps"

  build:
    needs: matrix
    if: ${{ needs.matrix.outputs.apps != '[]' }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        app: ${{ fromJSON(needs.matrix.outputs.apps) }}

    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5

      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve image name
        id: img
        run: |
          case "${{ matrix.app }}" in
            gateway|core) name="cloud-${{ matrix.app }}" ;;
            *)            name="cloud-app-${{ matrix.app }}" ;;
          esac
          owner="${{ github.repository_owner }}"
          echo "name=ghcr.io/${owner,,}/$name" >> "$GITHUB_OUTPUT"

      - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        id: meta
        with:
          images: ${{ steps.img.outputs.name }}
          tags: |
            type=sha,prefix=sha-,enable=${{ github.ref_type != 'tag' }}
            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
            type=match,pattern=cloud-.+-(v.+),group=1,enable=${{ startsWith(github.ref, 'refs/tags/cloud-') }}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/cloud-') }}

      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
          build-args: |
            APP_ID=${{ matrix.app }}
            CLOUD_RELEASE=${{ needs.matrix.outputs.release_tag }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.app }}
          cache-to: type=gha,mode=max,scope=${{ matrix.app }}

  release-set:
    needs: [matrix, build]
    if: ${{ needs.matrix.outputs.complete_set == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify complete immutable release set
        env:
          APPS_JSON: ${{ needs.matrix.outputs.apps }}
          OWNER: ${{ github.repository_owner }}
          RELEASE_TAG: ${{ needs.matrix.outputs.release_tag }}
        run: |
          set -euo pipefail
          OWNER="${OWNER,,}"
          while read -r app; do
            case "$app" in
              gateway|core) image="cloud-$app" ;;
              *) image="cloud-app-$app" ;;
            esac
            docker buildx imagetools inspect "ghcr.io/$OWNER/$image:$RELEASE_TAG" >/dev/null
          done < <(jq -r '.[]' <<<"$APPS_JSON")