ci-docker-build.yml

name: Docker

on:
  workflow_call:
    secrets:
      SENTRY_AUTH_TOKEN:
        required: false
      SENTRY_ORG:
        required: false
      SENTRY_PROJECT:
        required: false
    inputs:
      should_skip:
        description: "Whether to skip the workflow"
        required: false
        type: string
        default: "false"
      # publish and single_arch have no default; reusable-docker-build.yml says why.
      publish:
        description: "Whether image jobs may write to the registry"
        required: true
        type: boolean
      single_arch:
        description: "Whether to build linux/amd64 alone instead of the supported multi-architecture set"
        required: true
        type: string
      webapp_changed:
        description: "Whether webapp files changed (or should build for other reasons)"
        required: false
        type: string
        default: "true"
      application_server_changed:
        description: "Whether the Build workflow published an application-server image this run"
        required: false
        type: string
        default: "true"
      agent_images_changed:
        description: "Whether agent image files changed (or should build for other reasons)"
        required: false
        type: string
        default: "true"
      postgres_image_changed:
        description: "Whether the PostgreSQL image inputs changed"
        required: false
        type: string
        default: "true"

permissions: {}

jobs:
  webapp-build:
    name: "Webapp"
    if: inputs.should_skip != 'true' && inputs.webapp_changed == 'true'
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    secrets:
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
      SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
    with:
      image-name: "hephaestus-build/webapp"
      docker-file: "./webapp/Dockerfile"
      docker-context: "."
      registry: "ghcr.io"
      # Use the PR source branch; ref_name identifies GitHub's synthetic merge ref on pull requests.
      build-args: |
        SOURCE_COMMIT=${{ github.sha }}
        COOLIFY_BRANCH=${{ github.head_ref || github.ref_name }}
      publish: ${{ inputs.publish }}
      single-arch: ${{ inputs.single_arch == 'true' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Webapp
        org.opencontainers.image.description=Web client for Hephaestus
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=webapp

  agent-pi-build:
    name: "Agent: Pi"
    if: inputs.should_skip != 'true' && inputs.agent_images_changed == 'true'
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image-name: "hephaestus-build/agent-pi"
      docker-file: "./docker/agents/pi/Dockerfile"
      docker-context: "./docker/agents"
      registry: "ghcr.io"
      # Cache-busts the OS-package upgrade layer; this build imports the `cache-main` registry cache.
      build-args: |
        SOURCE_COMMIT=${{ github.sha }}
      publish: ${{ inputs.publish }}
      single-arch: ${{ inputs.single_arch == 'true' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Agent - Pi
        org.opencontainers.image.description=Sandboxed Pi coding agent for AI-powered code review
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=agent-pi

  postgres-build:
    name: "Postgres (pg_partman)"
    if: inputs.should_skip != 'true' && inputs.postgres_image_changed == 'true'
    uses: ./.github/workflows/reusable-docker-build.yml
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    with:
      image-name: "hephaestus-build/postgres"
      docker-file: "./docker/postgres/Dockerfile"
      docker-context: "./docker/postgres"
      registry: "ghcr.io"
      # Cache-busts the OS-package upgrade layer; this build imports the `cache-main` registry cache.
      build-args: |
        SOURCE_COMMIT=${{ github.sha }}
      publish: ${{ inputs.publish }}
      single-arch: ${{ inputs.single_arch == 'true' }}
      labels: |
        org.opencontainers.image.title=Hephaestus Postgres
        org.opencontainers.image.description=PostgreSQL + pg_partman for all environments (dev/preview/prod)
        org.opencontainers.image.vendor=AET TUM
        org.opencontainers.image.licenses=MIT
        hephaestus.component=postgres

  # Preview stacks resolve every component by PR head SHA; alias verified base digests for unchanged components.
  tag-unchanged-images:
    name: "Tag unchanged images"
    if: >-
      inputs.should_skip != 'true' && inputs.publish && github.event_name == 'pull_request' &&
      (inputs.webapp_changed != 'true' || inputs.application_server_changed != 'true' ||
       inputs.agent_images_changed != 'true' ||
       inputs.postgres_image_changed != 'true')
    timeout-minutes: 15
    runs-on: ubuntu-latest
    permissions:
      packages: write
      attestations: read
      contents: read
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Log in to Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify and tag unchanged images
        id: tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WEBAPP_CHANGED: ${{ inputs.webapp_changed }}
          APPLICATION_SERVER_CHANGED: ${{ inputs.application_server_changed }}
          AGENT_IMAGES_CHANGED: ${{ inputs.agent_images_changed }}
          POSTGRES_IMAGE_CHANGED: ${{ inputs.postgres_image_changed }}
          PR_NUMBER: ${{ github.event.number }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          REPOSITORY: ${{ github.repository }}
          REPOSITORY_OWNER: ${{ github.repository_owner }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail

          tag_image() {
            local image="ghcr.io/hephaestus-build/$1"
            local source="$image:$BASE_SHA"
            local digest
            digest=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$source" 2>/dev/null || true)
            if [[ ! "$digest" =~ ^sha256:[a-f0-9]{64}$ ]]; then
              local merged_head
              merged_head=$(gh api "repos/$REPOSITORY/commits/$BASE_SHA/pulls" \
                --jq '[.[] | select(.merged_at != null)][0].head.sha // empty')
              if [ -n "$merged_head" ]; then
                source="$image:$merged_head"
                digest=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$source" 2>/dev/null || true)
              fi
            fi
            if [[ ! "$digest" =~ ^sha256:[a-f0-9]{64}$ ]]; then
              echo "::error::Invalid digest for $source: ${digest:-<empty>}"
              return 1
            fi
            local verified="$image@$digest"
            cosign verify "$verified" \
              --certificate-identity-regexp "^https://github\\.com/$REPOSITORY/\\.github/workflows/reusable-docker-build\\.yml@" \
              --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
              --certificate-github-workflow-repository "$REPOSITORY" \
              > /dev/null
            gh attestation verify "oci://$verified" --owner "$REPOSITORY_OWNER"
            docker buildx imagetools create \
              --tag "$image:$HEAD_SHA" \
              --tag "$image:pr-$PR_NUMBER" \
              "$verified"
          }

          [ "$WEBAPP_CHANGED" = "true" ] || tag_image webapp
          [ "$APPLICATION_SERVER_CHANGED" = "true" ] || tag_image application-server
          [ "$AGENT_IMAGES_CHANGED" = "true" ] || tag_image agent-pi
          [ "$POSTGRES_IMAGE_CHANGED" = "true" ] || tag_image postgres