ci-docker-build.yml

name: Docker

on:
  workflow_call:
    inputs:
      should_skip:
        description: "Whether to skip the workflow"
        required: false
        type: string
        default: "false"
      # Path-based change detection for selective Docker builds
      # These are pre-computed by the caller (cicd.yml) to include CI config fallback
      webapp_changed:
        description: "Whether webapp files changed (or should build for other reasons)"
        required: false
        type: string
        default: "true"
      application_server_changed:
        description: "Whether application-server files changed (or should build for other reasons)"
        required: false
        type: string
        default: "true"
      agent_images_changed:
        description: "Whether agent image files changed (or should build for other reasons)"
        required: false
        type: string
        default: "true"
      postgres_image_changed:
        description: "Whether the PostgreSQL image inputs changed"
        required: false
        type: string
        default: "true"

    outputs:
      application-server-published:
        description: "Whether an application-server image exists at this commit"
        value: ${{ jobs.application-server-build.outputs.manifest-digest != '' || jobs.tag-unchanged-images.outputs.application-server-published == 'true' }}

permissions: {}

jobs:
  webapp-build:
    name: "Webapp"
    if: inputs.should_skip != 'true' && inputs.webapp_changed == 'true'
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image-name: "ls1intum/hephaestus/webapp"
      docker-file: "./webapp/Dockerfile"
      docker-context: "."
      registry: "ghcr.io"
      # Bake commit + branch (the Dockerfile's ARGs) so the footer build strip is
      # populated on CI-built deploys; Coolify sets these itself for previews.
      # head_ref, not ref_name: on a pull request the latter is the merge ref `<n>/merge`, which is
      # not a branch and does not resolve as one — the footer links it and got a 404.
      build-args: |
        SOURCE_COMMIT=${{ github.sha }}
        COOLIFY_BRANCH=${{ github.head_ref || github.ref_name }}
      # amd64-only on PRs (main/release build both arches). See reusable-docker-build.yml.
      single-arch: ${{ github.event_name == 'pull_request' }}
      tags: |
        ${{ github.ref_name }}
        ${{ github.sha }}
        ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
        ci-${{ github.run_number }}
        ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Webapp
        org.opencontainers.image.description=Web client for Hephaestus
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=webapp

  application-server-build:
    name: "App Server"
    if: >-
      inputs.should_skip != 'true' &&
      (inputs.application_server_changed == 'true' || github.event_name != 'pull_request')
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image-name: "ls1intum/hephaestus/application-server"
      # Paketo Cloud Native Buildpacks via spring-boot:build-image, with Application CDS.
      # See docs/admin/buildpacks-cds-decision.md and pom.xml's <image> block.
      use-buildpacks: true
      maven-module: "server/application"
      registry: "ghcr.io"
      # amd64-only on PRs (main/release build both arches). See reusable-docker-build.yml.
      single-arch: ${{ github.event_name == 'pull_request' }}
      # github.sha is a synthetic merge commit on pull_request. Coolify injects the checked-out PR
      # head as SOURCE_COMMIT, so publish both immutable identifiers.
      tags: |
        ${{ github.ref_name }}
        ${{ github.sha }}
        ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
        ci-${{ github.run_number }}
        ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Application Server
        org.opencontainers.image.description=Spring Boot server for Hephaestus
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=application-server

  # Note: the inbound webhook receiver lives in the application-server image
  # (integration.core.webhook package) and is deployed as a separate container via
  # SPRING_PROFILES_ACTIVE=prod,webhook. No separate image build is required. See
  # docker/compose.core.yaml (webhook-server service) and ADR 0008.

  agent-pi-build:
    name: "Agent: Pi"
    if: inputs.should_skip != 'true' && inputs.agent_images_changed == 'true'
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image-name: "ls1intum/hephaestus/agent-pi"
      docker-file: "./docker/agents/pi/Dockerfile"
      docker-context: "./docker/agents"
      registry: "ghcr.io"
      # amd64-only on PRs (main/release build both arches). See reusable-docker-build.yml.
      single-arch: ${{ github.event_name == 'pull_request' }}
      # The head-SHA tag matters here for the same reason it does on application-server: a preview
      # runs at SOURCE_COMMIT and derives its agent image from that tag, so without it no preview can
      # ever resolve a matched pair, however the pull request touched the agent tree (ADR 0031).
      tags: |
        ${{ github.ref_name }}
        ${{ github.sha }}
        ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
        ci-${{ github.run_number }}
        ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Agent - Pi
        org.opencontainers.image.description=Sandboxed Pi coding agent for AI-powered code review
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=agent-pi

  postgres-build:
    name: "Postgres (pg_partman)"
    if: >-
      inputs.should_skip != 'true' &&
      (inputs.postgres_image_changed == 'true' || github.event_name != 'pull_request')
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image-name: "ls1intum/hephaestus/postgres"
      docker-file: "./docker/postgres/Dockerfile"
      docker-context: "./docker/postgres"
      registry: "ghcr.io"
      # amd64-only on PRs (main/release build both arches). See reusable-docker-build.yml.
      single-arch: ${{ github.event_name == 'pull_request' }}
      tags: |
        ${{ github.ref_name }}
        ${{ github.sha }}
        ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
        ci-${{ github.run_number }}
        ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Postgres
        org.opencontainers.image.description=PostgreSQL + pg_partman for all environments (dev/preview/prod)
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=postgres

  # Preview stacks use one commit tag for every component. Point unchanged components at their
  # verified base-commit digest instead of rebuilding identical content under a new name.
  tag-unchanged-images:
    name: "Tag unchanged images"
    if: >-
      inputs.should_skip != 'true' && github.event_name == 'pull_request' &&
      (inputs.webapp_changed != 'true' || inputs.application_server_changed != 'true' ||
       inputs.agent_images_changed != 'true' ||
       inputs.postgres_image_changed != 'true')
    runs-on: ubuntu-latest
    outputs:
      application-server-published: ${{ steps.tag.outputs.application-server-published }}
    permissions:
      packages: write
      attestations: read
      contents: read
    steps:
      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify and tag unchanged images
        id: tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WEBAPP_CHANGED: ${{ inputs.webapp_changed }}
          APPLICATION_SERVER_CHANGED: ${{ inputs.application_server_changed }}
          AGENT_IMAGES_CHANGED: ${{ inputs.agent_images_changed }}
          POSTGRES_IMAGE_CHANGED: ${{ inputs.postgres_image_changed }}
          PR_NUMBER: ${{ github.event.number }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail

          tag_image() {
            local image="ghcr.io/ls1intum/hephaestus/$1"
            local source="$image:$BASE_SHA"
            local ref_tag="${GITHUB_REF_NAME//\//-}"
            local digest
            digest=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$source" 2>/dev/null || true)
            if [[ ! "$digest" =~ ^sha256:[a-f0-9]{64}$ ]]; then
              local merged_head
              merged_head=$(gh api "repos/$REPOSITORY/commits/$BASE_SHA/pulls" \
                --jq '[.[] | select(.merged_at != null)][0].head.sha // empty')
              if [ -n "$merged_head" ]; then
                source="$image:$merged_head"
                digest=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$source" 2>/dev/null || true)
              fi
            fi
            if [[ ! "$digest" =~ ^sha256:[a-f0-9]{64}$ ]]; then
              echo "::error::Invalid digest for $source: ${digest:-<empty>}"
              return 1
            fi
            local verified="$image@$digest"
            gh attestation verify "oci://$verified" --owner "${{ github.repository_owner }}"
            docker buildx imagetools create \
              --tag "$image:$ref_tag" \
              --tag "$image:${{ github.sha }}" \
              --tag "$image:${{ github.event.pull_request.head.sha }}" \
              --tag "$image:ci-${{ github.run_number }}" \
              --tag "$image:pr-$PR_NUMBER" \
              "$verified"
          }

          [ "$WEBAPP_CHANGED" = "true" ] || tag_image webapp
          if [ "$APPLICATION_SERVER_CHANGED" != "true" ]; then
            tag_image application-server
            echo "application-server-published=true" >> "$GITHUB_OUTPUT"
          fi
          [ "$AGENT_IMAGES_CHANGED" = "true" ] || tag_image agent-pi
          [ "$POSTGRES_IMAGE_CHANGED" = "true" ] || tag_image postgres