build-docker-image.yml

name: Appsmith Build Docker Image Workflow

on:
  # This line enables manual triggering of this workflow.
  workflow_dispatch:
  workflow_call:
    inputs:
      branch:
        description: "Branch to checkout when pr is 0 (must match client/server/rts builds)"
        required: false
        type: string
        default: ""
      pr:
        description: "This is the PR number in case the workflow is being called in a pull request"
        required: false
        type: number
      checkout-ref:
        description: "Immutable commit SHA to checkout for an approved external PR"
        required: false
        type: string
        default: ""

jobs:
  build-docker:
    runs-on: ubuntu-latest
    if: |
      github.event.pull_request.head.repo.full_name == github.repository ||
      github.event_name == 'push' ||
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'repository_dispatch' ||
      github.event_name == 'schedule'
    defaults:
      run:
        shell: bash

    steps:
      # Check out merge commit
      - name: Fork based /ok-to-test checkout
        if: inputs.checkout-ref == '' && inputs.pr != 0
        uses: actions/checkout@v4
        with:
          ref: "refs/pull/${{ inputs.pr }}/merge"

      # Checkout the code in the current branch in case the workflow is called because of a branch push event
      - name: Checkout the head commit of the branch
        if: inputs.checkout-ref == '' && inputs.pr == 0 && inputs.branch == ''
        uses: actions/checkout@v4

      - name: Checkout the specified branch
        if: inputs.checkout-ref == '' && inputs.pr == 0 && inputs.branch != ''
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}

      - name: Checkout the approved immutable commit
        if: inputs.checkout-ref != ''
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.checkout-ref }}

      - name: Download the client build artifact
        if: steps.run_result.outputs.run_result != 'success'
        uses: actions/download-artifact@v4
        with:
          name: client-build
          path: app/client

      - name: Unpack the client build artifact
        if: steps.run_result.outputs.run_result != 'success'
        run: |
          mkdir -p app/client/build
          tar -xvf app/client/build.tar -C app/client/build

      - name: Download the server build artifact
        if: steps.run_result.outputs.run_result != 'success'
        uses: actions/download-artifact@v4
        with:
          name: server-build
          path: app/server/dist/

      - name: Download the rts build artifact
        if: steps.run_result.outputs.run_result != 'success'
        uses: actions/download-artifact@v4
        with:
          name: rts-dist
          path: app/client/packages/rts/dist

      - name: Un-tar the rts folder
        run: |
          tar -xvf app/client/packages/rts/dist/rts-dist.tar -C app/client/packages/rts/
          echo "Cleaning up the tar files"
          rm app/client/packages/rts/dist/rts-dist.tar

      - name: Generate info.json
        id: info_json
        run: |
          scripts/generate_info_json.sh

      - name: Place server artifacts-es
        env:
          EDITION: ${{ vars.EDITION }}
        run: |
          scripts/prepare_server_artifacts.sh

      - name: Set base image tag
        id: set_base_tag
        run: |
          if [[ "${{ inputs.pr }}" != 0 || "${{ github.ref_name }}" != master ]]; then
            base_tag=release
          else
            base_tag=nightly
          fi
          echo "base_tag=$base_tag" >> $GITHUB_OUTPUT


      # We don't use Depot Docker builds because it's faster for local Docker images to be built locally.
      # It's slower and more expensive to build these Docker images on Depot and download it back to the CI node.
      - name: Build docker image
        if: steps.run_result.outputs.run_result != 'success'
        working-directory: "."
        run: |
          set -o xtrace
          declare -a args
          base_tag=${{ steps.set_base_tag.outputs.base_tag }}
          if [[ base_tag != 'nightly' ]]; then
            args+=(--build-arg "APPSMITH_CLOUD_SERVICES_BASE_URL=https://release-cs.appsmith.com")
          fi
          args+=(--build-arg "BASE=${{ vars.DOCKER_HUB_ORGANIZATION }}/base-${{ vars.EDITION }}:$base_tag")
          args+=(--label "org.opencontainers.image.revision=${{ steps.info_json.outputs.commitSha }}")
          args+=(--label "org.opencontainers.image.source=${{ steps.info_json.outputs.repo }}")
          args+=(--label "org.opencontainers.image.version=${{ steps.info_json.outputs.version }}")
          docker build -t cicontainer "${args[@]}" .

      # Push the SUT image to GHCR so test jobs can pull it with layer-level
      # parallelism instead of restoring a single-blob tarball from the Actions
      # cache. Old run-<id> tags are pruned by ghcr-citest-retention.yml.
      - name: Push docker image to GHCR
        env:
          GHCR_IMAGE: ghcr.io/${{ github.repository }}-citest:run-${{ github.run_id }}
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
          docker tag cicontainer "$GHCR_IMAGE"
          docker push "$GHCR_IMAGE"

      - name: Save the status of the run
        run: echo "run_result=success" >> $GITHUB_OUTPUT > ~/run_result