build.yml

name: Build and Deploy Garnet

on:
  workflow_dispatch:
  push:
    tags:
      - v*
    branches:
      - deploy/staging
      - deploy/prod
      - garnet-privacy-proxy
    paths:
      - 'backend/privacy_proxy/**'
      - 'src/**'
      - 'backend/open_webui/**'
      - 'Dockerfile'
      - 'docker-compose.yml'
      - 'version/VERSION'
      - '.github/workflows/**'
  pull_request:
    branches:
      - garnet-privacy-proxy

jobs:

  # ── GET VERSION + TAG ─────────────────────────────────
  get-meta:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get_version.outputs.version }}
      tag: ${{ steps.get_tag.outputs.name }}
      revision: ${{ steps.get_revision.outputs.revision }}
      proxy_changed: ${{ steps.changes.outputs.proxy }}
      webui_changed: ${{ steps.changes.outputs.webui }}
    steps:
      - name: Checkout
        run: |
          git clone --branch ${{ github.ref_name }} \
            https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .

      - name: Get version
        id: get_version
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
          else
            echo "version=$(cat version/VERSION).nightly" >> $GITHUB_OUTPUT
          fi

      - name: Get revision
        id: get_revision
        run: echo "revision=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Get tag
        id: get_tag
        run: |
          case "${GITHUB_REF}" in
            refs/heads/deploy/staging) NAME=staging ;;
            refs/heads/deploy/prod)    NAME=prod    ;;
            refs/tags/v*)              NAME=latest  ;;
            *)                         NAME="${FALLBACK}" ;;
          esac
          echo "name=${NAME}" >> $GITHUB_OUTPUT
        env:
          FALLBACK: ${{ steps.get_revision.outputs.revision }}

      - name: Check changed files
        id: changes
        run: |
          git diff --name-only HEAD~1 HEAD | grep '^backend/privacy_proxy/' \
            && echo "proxy=true" >> $GITHUB_OUTPUT \
            || echo "proxy=false" >> $GITHUB_OUTPUT
          git diff --name-only HEAD~1 HEAD | grep -E '^src/|^backend/open_webui/' \
            && echo "webui=true" >> $GITHUB_OUTPUT \
            || echo "webui=false" >> $GITHUB_OUTPUT

  # ── SECRET SCAN (PR) ──────────────────────────────────
  secret-scan-pr:
    needs: get-meta
    if: github.event_name == 'pull_request'
    uses: enclaive/security-workflows/.github/workflows/trufflehog-pr.yml@v1

  # ── SECRET SCAN (FULL) ────────────────────────────────
  secret-scan-full:
    needs: get-meta
    if: github.event_name == 'push'
    uses: enclaive/security-workflows/.github/workflows/trufflehog-full.yml@v1

  # ── PROXY ─────────────────────────────────────────────
  build-proxy:
    needs: get-meta
    if: needs.get-meta.outputs.proxy_changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        run: |
          git clone --branch ${{ github.ref_name }} \
            https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
          df -h

      - name: Set up Docker Buildx
        run: |
          docker buildx create --use --name garnet-builder
          docker buildx inspect --bootstrap

      - name: Login to Harbor
        run: |
          echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \
            -u "${{ secrets.HARBOR_USERNAME }}" --password-stdin

      - name: Build and push proxy image
        id: build-proxy
        run: |
          DIGEST=$(docker buildx build \
            -f backend/privacy_proxy/Dockerfile \
            --build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \
            --build-arg PRODUCT_REVISION=${{ needs.get-meta.outputs.revision }} \
            --cache-from type=registry,ref=harbor.enclaive.cloud/garnetdemo/privacy-proxy:cache \
            --cache-to   type=registry,ref=harbor.enclaive.cloud/garnetdemo/privacy-proxy:cache,mode=max \
            --tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.tag }} \
            --tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.version }} \
            --tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.revision }} \
            --tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:gh-run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.run_number }} \
            --push \
            --metadata-file /tmp/proxy-meta.json \
            backend/privacy_proxy/ && \
          cat /tmp/proxy-meta.json | python3 -c "import sys,json; print(json.load(sys.stdin)['containerimage.digest'])")
          echo "digest=harbor.enclaive.cloud/garnetdemo/privacy-proxy@${DIGEST}" >> $GITHUB_OUTPUT

      - name: Install cosign
        run: |
          curl -sfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
            -o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign

      - name: Sign proxy image
        run: |
          echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
          chmod 600 /tmp/cosign.key
          COSIGN_PASSWORD="" cosign sign --yes --key /tmp/cosign.key \
            ${{ steps.build-proxy.outputs.digest }}
          rm /tmp/cosign.key

  # ── PYTHON CHECKS (pip-audit, ruff, mypy, trivy, bandit) ──
  python-checks:
    needs: [get-meta, build-proxy]
    if: needs.get-meta.outputs.proxy_changed == 'true'
    uses: ./.github/workflows/pythoncheck.yml
    with:
      image_tag: ${{ needs.get-meta.outputs.revision }}
    secrets:
      HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
      HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}

  # ── DEPLOY PROXY ──────────────────────────────────────
  deploy-proxy:
    needs: [get-meta, build-proxy, python-checks]
    if: needs.get-meta.outputs.proxy_changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Deploy proxy to cVM
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan ${{ secrets.CVM_HOST }} >> ~/.ssh/known_hosts
          ssh root@${{ secrets.CVM_HOST }} "cd /opt/garnet && \
            echo '${{ secrets.HARBOR_PASSWORD }}' | docker login harbor.enclaive.cloud \
              -u '${{ secrets.HARBOR_USERNAME }}' --password-stdin && \
            docker compose pull privacy-proxy && \
            docker compose up -d --force-recreate privacy-proxy"

      - name: Health check proxy
        run: |
          sleep 10
          ssh root@${{ secrets.CVM_HOST }} "\
            docker exec garnet-privacy-proxy-1 python3 -c \
            'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/health\").read())'"

  # ── RUN TESTS ─────────────────────────────────────────
  run-tests:
    needs: deploy-proxy
    if: needs.get-meta.outputs.proxy_changed == 'true'
    uses: ./.github/workflows/proxy-tests.yml
    secrets:
      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
      CVM_HOST: ${{ secrets.CVM_HOST }}

  # ── WEBUI ─────────────────────────────────────────────
  build-webui:
    needs: get-meta
    if: needs.get-meta.outputs.webui_changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        run: |
          git clone --branch ${{ github.ref_name }} \
            https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
          df -h

      - name: Set up Docker Buildx
        run: |
          docker buildx create --use --name garnet-builder
          docker buildx inspect --bootstrap

      - name: Login to Harbor
        run: |
          echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \
            -u "${{ secrets.HARBOR_USERNAME }}" --password-stdin

      - name: Build and push webui image
        id: build-webui
        run: |
          DIGEST=$(docker buildx build \
            --build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \
            --build-arg PRODUCT_REVISION=${{ needs.get-meta.outputs.revision }} \
            --cache-from type=registry,ref=harbor.enclaive.cloud/garnetdemo/garnet-webui:cache \
            --cache-to   type=registry,ref=harbor.enclaive.cloud/garnetdemo/garnet-webui:cache,mode=max \
            --tag harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.tag }} \
            --tag harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.version }} \
            --tag harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.revision }} \
            --tag harbor.enclaive.cloud/garnetdemo/garnet-webui:gh-run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.run_number }} \
            --push \
            --metadata-file /tmp/webui-meta.json \
            . && \
          cat /tmp/webui-meta.json | python3 -c "import sys,json; print(json.load(sys.stdin)['containerimage.digest'])")
          echo "digest=harbor.enclaive.cloud/garnetdemo/garnet-webui@${DIGEST}" >> $GITHUB_OUTPUT

      - name: Install cosign
        run: |
          curl -sfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
            -o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign

      - name: Sign webui image
        run: |
          sleep 10
          echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
          chmod 600 /tmp/cosign.key
          COSIGN_PASSWORD="" cosign sign --yes --key /tmp/cosign.key \
            ${{ steps.build-webui.outputs.digest }}
          rm /tmp/cosign.key

  # ── DEPLOY WEBUI ──────────────────────────────────────
  deploy-webui:
    needs: [get-meta, build-webui]
    if: needs.get-meta.outputs.webui_changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Deploy webui to cVM
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan ${{ secrets.CVM_HOST }} >> ~/.ssh/known_hosts
          ssh root@${{ secrets.CVM_HOST }} "cd /opt/garnet && \
            echo '${{ secrets.HARBOR_PASSWORD }}' | docker login harbor.enclaive.cloud \
              -u '${{ secrets.HARBOR_USERNAME }}' --password-stdin && \
            docker compose pull open-webui && \
            docker compose up -d --force-recreate open-webui"

      - name: Health check webui
        run: |
          sleep 15
          ssh root@${{ secrets.CVM_HOST }} "\
            docker exec garnet-open-webui-1 python3 -c \
            'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/\").read()[:50])'"