docker-build-push.yml

# This workflow is used to build and push the Docker image for n8nio/n8n and n8nio/runners
#
# - Uses docker-config.mjs for context determination, this determines what needs to be built based on the trigger
# - Uses docker-tags.mjs for tag generation, this generates the tags for the images

name: 'Docker: Build and Push'
run-name: "${{ github.event_name == 'workflow_dispatch' && format('Docker: Build and Push {0} (push={1}, arm64={2})', github.ref_name, inputs.push_enabled, inputs.include_arm64) || '' }}"

env:
  NODE_OPTIONS: '--max-old-space-size=7168'
  NODE_VERSION: '26.7.0'

on:
  schedule:
    - cron: '0 0 * * *'

  workflow_call:
    inputs:
      n8n_version:
        description: 'N8N version to build'
        required: true
        type: string
      release_type:
        description: 'Release type (stable, nightly, dev)'
        required: false
        type: string
        default: 'stable'
      push_enabled:
        description: 'Whether to push the built images'
        required: false
        type: boolean
        default: true
      ref:
        description: 'Git ref (branch/tag/sha) to build from. Empty checks out the triggering ref.'
        required: false
        type: string
        default: ''
      date_tag:
        description: 'Optional date suffix for an extra <version>-<date> tag (e.g. 20260625)'
        required: false
        type: string
        default: ''
      create_attestations:
        description: 'Create release provenance, VEX, and SBOM attestations'
        required: false
        type: boolean
        default: false
    outputs:
      # Repo name + multi-arch manifest digest per image, so callers can promote what
      # was actually pushed (retag by digest) instead of re-deriving tag strings.
      # Empty when push_enabled is false — the manifest job doesn't run.
      n8n_image:
        description: 'GHCR repo for the n8n image (no tag)'
        value: ${{ jobs.create_multi_arch_manifest.outputs.n8n_image }}
      n8n_digest:
        description: 'Multi-arch manifest digest of the n8n image'
        value: ${{ jobs.create_multi_arch_manifest.outputs.n8n_digest }}
      runners_image:
        description: 'GHCR repo for the runners image (no tag)'
        value: ${{ jobs.create_multi_arch_manifest.outputs.runners_image }}
      runners_digest:
        description: 'Multi-arch manifest digest of the runners image'
        value: ${{ jobs.create_multi_arch_manifest.outputs.runners_digest }}
      runners_distroless_image:
        description: 'GHCR repo for the distroless runners image (no tag; same repo as runners)'
        value: ${{ jobs.create_multi_arch_manifest.outputs.runners_distroless_image }}
      runners_distroless_digest:
        description: 'Multi-arch manifest digest of the distroless runners image'
        value: ${{ jobs.create_multi_arch_manifest.outputs.runners_distroless_digest }}

  workflow_dispatch:
    inputs:
      push_enabled:
        description: 'Push image to registry'
        required: false
        type: boolean
        default: true
      include_arm64:
        description: 'Also build linux/arm64 (default is amd64-only for manual/branch builds)'
        required: false
        type: boolean
        default: false
      success_url:
        description: 'URL to call after the build is successful'
        required: false
        type: string

jobs:
  determine-build-context:
    name: Determine Build Context
    runs-on: ubuntu-latest
    outputs:
      release_type: ${{ steps.context.outputs.release_type }}
      n8n_version: ${{ steps.context.outputs.version }}
      push_enabled: ${{ steps.context.outputs.push_enabled }}
      push_to_docker: ${{ steps.context.outputs.push_to_docker }}
      build_matrix: ${{ steps.context.outputs.build_matrix }}
      short_sha: ${{ steps.sha.outputs.short_sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.ref }}

      - name: Resolve built commit SHA
        id: sha
        # From the checked-out working tree (honours `ref`), not GITHUB_SHA — which
        # is the triggering ref (e.g. master) and would mislabel a ref-override build.
        run: echo "short_sha=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"

      - name: Determine build context
        id: context
        env:
          N8N_VERSION: ${{ inputs.n8n_version }}
          RELEASE_TYPE: ${{ inputs.release_type }}
          PUSH_ENABLED: ${{ inputs.push_enabled }}
          INCLUDE_ARM64: ${{ inputs.include_arm64 }}
          GITHUB_REF: ${{ github.ref_name }}
        run: |
          node .github/scripts/docker/docker-config.mjs \
            --event "${{ github.event_name }}" \
            --pr "${{ github.event.pull_request.number }}" \
            --branch "$GITHUB_REF" \
            --version "$N8N_VERSION" \
            --release-type "$RELEASE_TYPE" \
            --push-enabled "$PUSH_ENABLED" \
            --include-arm64 "$INCLUDE_ARM64"

  build-app:
    name: Build application for Docker images
    needs: determine-build-context
    runs-on: blacksmith-8vcpu-ubuntu-2204
    timeout-minutes: 35
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: useblacksmith/checkout@046e27863876319367379f972a0c394bee91aee1 # v1.4.0
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
          persist-credentials: false

      - name: Setup and Build
        uses: ./.github/actions/setup-nodejs
        with:
          # The image compiles native bindings against this Node version later.
          node-version: ${{ env.NODE_VERSION }}
          build-command: pnpm build:n8n
        env:
          RELEASE: ${{ needs.determine-build-context.outputs.n8n_version }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      # Blacksmith routes actions/cache through its cache backend. The cache archive
      # preserves pnpm symlinks and executable modes across the job boundary.
      - name: Save Docker build context
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: docker-build-context-v1-${{ github.run_id }}
          path: |
            compiled
            dist/task-runner-javascript

  build-and-push-docker:
    name: Build and Push Docker Image (${{ matrix.platform }})
    needs: [determine-build-context, build-app]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 35
    permissions:
      actions: read
      contents: read
      packages: write
    strategy:
      matrix: ${{ fromJSON(needs.determine-build-context.outputs.build_matrix) }}
    outputs:
      image_ref: ${{ steps.determine-tags.outputs.n8n_primary_tag }}
      primary_ghcr_manifest_tag: ${{ steps.determine-tags.outputs.n8n_primary_tag }}
      n8n_pc_primary_ghcr_manifest_tag: ${{ steps.determine-tags.outputs.n8n_pc_primary_tag }}
      n8n_pc_sha_manifest_tag: ${{ steps.determine-tags.outputs.n8n_pc_sha_primary_tag }}
      n8n_pc_date_manifest_tag: ${{ steps.determine-tags.outputs.n8n_pc_date_primary_tag }}
      runners_primary_ghcr_manifest_tag: ${{ steps.determine-tags.outputs.runners_primary_tag }}
      runners_distroless_primary_ghcr_manifest_tag: ${{ steps.determine-tags.outputs.runners_distroless_primary_tag }}
      n8n_sha_manifest_tag: ${{ steps.determine-tags.outputs.n8n_sha_primary_tag }}
      runners_sha_manifest_tag: ${{ steps.determine-tags.outputs.runners_sha_primary_tag }}
      runners_distroless_sha_manifest_tag: ${{ steps.determine-tags.outputs.runners_distroless_sha_primary_tag }}
      n8n_date_manifest_tag: ${{ steps.determine-tags.outputs.n8n_date_primary_tag }}
      runners_date_manifest_tag: ${{ steps.determine-tags.outputs.runners_date_primary_tag }}
      runners_distroless_date_manifest_tag: ${{ steps.determine-tags.outputs.runners_distroless_date_primary_tag }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 1
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: useblacksmith/setup-docker-builder@a5256a73e30f09e37e3eceb8ca36043d17621d24 # v2.1.0
        with:
          # Blacksmith stores a separate Sticky Disk variant per architecture.
          cache-key: n8n-io/n8n

      - name: Restore Docker build context
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          key: docker-build-context-v1-${{ github.run_id }}
          path: |
            compiled
            dist/task-runner-javascript
          fail-on-cache-miss: true

      - name: Determine Docker tags for all images
        id: determine-tags
        env:
          DATE_TAG: ${{ inputs.date_tag }}
          SHORT_SHA: ${{ needs.determine-build-context.outputs.short_sha }}
        run: |
          # Build the optional --date flag in shell (not via a template expansion) so
          # the caller-supplied input never expands directly into the command line.
          DATE_ARGS=()
          if [ -n "${DATE_TAG:-}" ]; then DATE_ARGS=(--date "$DATE_TAG"); fi

          node .github/scripts/docker/docker-tags.mjs \
            --all \
            --version "${{ needs.determine-build-context.outputs.n8n_version }}" \
            --platform "${{ matrix.docker_platform }}" \
            --sha "$SHORT_SHA" \
            "${DATE_ARGS[@]}" \
            ${{ needs.determine-build-context.outputs.push_to_docker == 'true' && '--include-docker' || '' }}

          echo "=== Generated Docker Tags ==="
          grep "_tags=" "$GITHUB_OUTPUT" | while IFS='=' read -r key value; do
            echo "${key}: ${value%%,*}..."  # Show first tag for brevity
          done

      - name: Login to Docker registries
        if: needs.determine-build-context.outputs.push_enabled == 'true'
        uses: ./.github/actions/docker-registry-login
        with:
          login-ghcr: true
          login-dockerhub: ${{ needs.determine-build-context.outputs.push_to_docker == 'true' }}
          dockerhub-username: ${{ secrets.DOCKER_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push Docker images
        env:
          N8N_VERSION: ${{ needs.determine-build-context.outputs.n8n_version }}
          N8N_RELEASE_TYPE: ${{ needs.determine-build-context.outputs.release_type }}
          PLATFORMS: ${{ matrix.docker_platform }}
          N8N_TAGS: ${{ steps.determine-tags.outputs.n8n_tags }}
          N8N_PC_TAGS: ${{ steps.determine-tags.outputs.n8n_pc_tags }}
          RUNNERS_TAGS: ${{ steps.determine-tags.outputs.runners_tags }}
          RUNNERS_DISTROLESS_TAGS: ${{ steps.determine-tags.outputs.runners_distroless_tags }}
          PUSH_ENABLED: ${{ needs.determine-build-context.outputs.push_enabled }}
        run: |
          TARGETS=(n8n runners runners-distroless)
          if [ -n "$N8N_PC_TAGS" ] && [ "$PUSH_ENABLED" = 'true' ]; then
            TARGETS+=(n8n-pc)
          fi

          # oci-mediatypes keeps the merged manifest an OCI image index. Older
          # containerd cannot pull a Docker manifest list that has attestation
          # manifests (#31997). create_multi_arch_manifest asserts the merged
          # format before the release proceeds.
          OUTPUT=()
          if [ "$PUSH_ENABLED" = 'true' ]; then
            OUTPUT=(--set '*.output=type=image,oci-mediatypes=true,push=true')
          fi

          docker buildx bake -f docker/docker-bake.hcl "${TARGETS[@]}" \
            --provenance=false \
            --sbom=false \
            --metadata-file /tmp/bake-metadata.json \
            "${OUTPUT[@]}"

  create_multi_arch_manifest:
    name: Create Multi-Arch Manifest
    needs: [determine-build-context, build-and-push-docker]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    if: |
      needs.build-and-push-docker.result == 'success' &&
      needs.determine-build-context.outputs.push_enabled == 'true'
    outputs:
      n8n_digest: ${{ steps.get-digests.outputs.n8n_digest }}
      n8n_image: ${{ steps.get-digests.outputs.n8n_image }}
      n8n_pc_digest: ${{ steps.get-digests.outputs.n8n_pc_digest }}
      n8n_pc_image: ${{ steps.get-digests.outputs.n8n_pc_image }}
      runners_digest: ${{ steps.get-digests.outputs.runners_digest }}
      runners_image: ${{ steps.get-digests.outputs.runners_image }}
      runners_distroless_digest: ${{ steps.get-digests.outputs.runners_distroless_digest }}
      runners_distroless_image: ${{ steps.get-digests.outputs.runners_distroless_image }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker registries
        uses: ./.github/actions/docker-registry-login
        with:
          login-ghcr: true
          login-dockerhub: ${{ needs.determine-build-context.outputs.push_to_docker == 'true' }}
          dockerhub-username: ${{ secrets.DOCKER_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Create GHCR multi-arch manifests
        env:
          BUILD_MATRIX: ${{ needs.determine-build-context.outputs.build_matrix }}
          N8N_DATE_MANIFEST_TAG: ${{ needs.build-and-push-docker.outputs.n8n_date_manifest_tag }}
          N8N_PC_DATE_MANIFEST_TAG: ${{ needs.build-and-push-docker.outputs.n8n_pc_date_manifest_tag }}
          RUNNERS_DATE_MANIFEST_TAG: ${{ needs.build-and-push-docker.outputs.runners_date_manifest_tag }}
          RUNNERS_DISTROLESS_DATE_MANIFEST_TAG: ${{ needs.build-and-push-docker.outputs.runners_distroless_date_manifest_tag }}
        run: |
          HAS_ARM64="$(node -e "const matrix = JSON.parse(process.env.BUILD_MATRIX); process.stdout.write(String(matrix.platform.includes('arm64')))")"

          # Function to create manifest for an image
          create_manifest() {
            local IMAGE_NAME=$1
            local MANIFEST_TAG=$2

            if [[ -z "$MANIFEST_TAG" ]]; then
              echo "Skipping $IMAGE_NAME - no manifest tag"
              return
            fi

            echo "Creating GHCR manifest for $IMAGE_NAME: $MANIFEST_TAG"

            if [[ "$HAS_ARM64" == "true" ]]; then
              docker buildx imagetools create \
                --tag "$MANIFEST_TAG" \
                "${MANIFEST_TAG}-amd64" \
                "${MANIFEST_TAG}-arm64"
            else
              docker buildx imagetools create \
                --tag "$MANIFEST_TAG" \
                "${MANIFEST_TAG}-amd64"
            fi
          }

          # Create manifests for all images
          create_manifest "n8n" "${{ needs.build-and-push-docker.outputs.primary_ghcr_manifest_tag }}"
          create_manifest "n8n-pc" "${{ needs.build-and-push-docker.outputs.n8n_pc_primary_ghcr_manifest_tag }}"
          create_manifest "runners" "${{ needs.build-and-push-docker.outputs.runners_primary_ghcr_manifest_tag }}"
          create_manifest "runners-distroless" "${{ needs.build-and-push-docker.outputs.runners_distroless_primary_ghcr_manifest_tag }}"

          # Create SHA-tagged manifests (immutable references for deployments)
          create_manifest "n8n (sha)" "${{ needs.build-and-push-docker.outputs.n8n_sha_manifest_tag }}"
          create_manifest "n8n-pc (sha)" "${{ needs.build-and-push-docker.outputs.n8n_pc_sha_manifest_tag }}"
          create_manifest "runners (sha)" "${{ needs.build-and-push-docker.outputs.runners_sha_manifest_tag }}"
          create_manifest "runners-distroless (sha)" "${{ needs.build-and-push-docker.outputs.runners_distroless_sha_manifest_tag }}"

          # Create date-tagged manifests. The *_DATE_MANIFEST_TAG vars are empty unless the
          # date_tag input was set (e.g. nightly), and create_manifest skips empty tags —
          # so these calls are no-ops on non-dated builds.
          create_manifest "n8n (date)" "$N8N_DATE_MANIFEST_TAG"
          create_manifest "n8n-pc (date)" "$N8N_PC_DATE_MANIFEST_TAG"
          create_manifest "runners (date)" "$RUNNERS_DATE_MANIFEST_TAG"
          create_manifest "runners-distroless (date)" "$RUNNERS_DISTROLESS_DATE_MANIFEST_TAG"

      # Gates the release on the format itself. 2.26.0 shipped as a Docker
      # manifest list and every pull failed on older containerd (#31997). The
      # exporter flags that keep this an OCI index live in the build job, but
      # the merge happens here, so this is the only place the published shape
      # can be asserted. Docker Hub merges separately below and is asserted there.
      - name: Assert merged GHCR manifests are OCI image indexes
        env:
          BUILD_MATRIX: ${{ needs.determine-build-context.outputs.build_matrix }}
          N8N_TAG: ${{ needs.build-and-push-docker.outputs.primary_ghcr_manifest_tag }}
          N8N_PC_TAG: ${{ needs.build-and-push-docker.outputs.n8n_pc_primary_ghcr_manifest_tag }}
          RUNNERS_TAG: ${{ needs.build-and-push-docker.outputs.runners_primary_ghcr_manifest_tag }}
          RUNNERS_DISTROLESS_TAG: ${{ needs.build-and-push-docker.outputs.runners_distroless_primary_ghcr_manifest_tag }}
        run: |
          set -euo pipefail
          EXPECT="$(node -e "const matrix = JSON.parse(process.env.BUILD_MATRIX); process.stdout.write(String(matrix.platform.length))")"

          for TAG in "$N8N_TAG" "$N8N_PC_TAG" "$RUNNERS_TAG" "$RUNNERS_DISTROLESS_TAG"; do
            [[ -n "$TAG" ]] || continue
            node .github/scripts/docker/assert-manifest-format.mjs "$TAG" --expect-platforms "$EXPECT"
          done

      - name: Create Docker Hub manifests
        if: needs.determine-build-context.outputs.push_to_docker == 'true'
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DATE_TAG: ${{ inputs.date_tag }}
          SHORT_SHA: ${{ needs.determine-build-context.outputs.short_sha }}
          N8N_PC_MANIFEST_TAG: ${{ needs.build-and-push-docker.outputs.n8n_pc_primary_ghcr_manifest_tag }}
        run: |
          VERSION="${{ needs.determine-build-context.outputs.n8n_version }}"
          DOCKER_BASE="$DOCKER_USERNAME"

          # Create manifests for each image type
          declare -A images=(
            ["n8n"]="${VERSION}"
            ["runners"]="${VERSION}"
            ["runners-distroless"]="${VERSION}-distroless"
          )
          if [[ -n "$N8N_PC_MANIFEST_TAG" ]]; then
            images["n8n-pc"]="${VERSION}-pc"
          fi

          for image in "${!images[@]}"; do
            TAG_SUFFIX="${images[$image]}"
            IMAGE_NAME="${image//-distroless/}"  # Remove the variant suffix from the image name
            IMAGE_NAME="${IMAGE_NAME//-pc/}"

            echo "Creating Docker Hub manifest for $image"
            docker buildx imagetools create \
              --tag "${DOCKER_BASE}/${IMAGE_NAME}:${TAG_SUFFIX}" \
              "${DOCKER_BASE}/${IMAGE_NAME}:${TAG_SUFFIX}-amd64" \
              "${DOCKER_BASE}/${IMAGE_NAME}:${TAG_SUFFIX}-arm64"

            # Self-hosted pulls come from here, and this merge is independent of
            # the GHCR one above, so it needs its own assertion. Always both
            # arches: push_to_docker is never set for amd64-only branch builds.
            node .github/scripts/docker/assert-manifest-format.mjs \
              "${DOCKER_BASE}/${IMAGE_NAME}:${TAG_SUFFIX}" --expect-platforms 2

            # Create SHA-tagged manifest (immutable reference)
            # For distroless, insert SHA between version and -distroless suffix
            # to match docker-tags.mjs format: nightly-abc1234-distroless (not nightly-distroless-abc1234)
            if [[ "$image" == *"-distroless"* ]]; then
              SHA_SUFFIX="${VERSION}-${SHORT_SHA}-distroless"
            elif [[ "$image" == *"-pc"* ]]; then
              SHA_SUFFIX="${VERSION}-${SHORT_SHA}-pc"
            else
              SHA_SUFFIX="${TAG_SUFFIX}-${SHORT_SHA}"
            fi
            echo "Creating Docker Hub SHA manifest for $image: ${SHA_SUFFIX}"
            docker buildx imagetools create \
              --tag "${DOCKER_BASE}/${IMAGE_NAME}:${SHA_SUFFIX}" \
              "${DOCKER_BASE}/${IMAGE_NAME}:${SHA_SUFFIX}-amd64" \
              "${DOCKER_BASE}/${IMAGE_NAME}:${SHA_SUFFIX}-arm64"

            # Create date-tagged manifest when a date suffix was provided (e.g. v3-nightly-20260625)
            # Mirrors the SHA suffix placement: <version>-<date> and <version>-<date>-distroless
            if [[ -n "$DATE_TAG" ]]; then
              if [[ "$image" == *"-distroless"* ]]; then
                DATE_SUFFIX="${VERSION}-${DATE_TAG}-distroless"
              elif [[ "$image" == *"-pc"* ]]; then
                DATE_SUFFIX="${VERSION}-${DATE_TAG}-pc"
              else
                DATE_SUFFIX="${TAG_SUFFIX}-${DATE_TAG}"
              fi
              echo "Creating Docker Hub date manifest for $image: ${DATE_SUFFIX}"
              docker buildx imagetools create \
                --tag "${DOCKER_BASE}/${IMAGE_NAME}:${DATE_SUFFIX}" \
                "${DOCKER_BASE}/${IMAGE_NAME}:${DATE_SUFFIX}-amd64" \
                "${DOCKER_BASE}/${IMAGE_NAME}:${DATE_SUFFIX}-arm64"
            fi
          done

      - name: Get manifest digests for attestation
        id: get-digests
        env:
          N8N_TAG: ${{ needs.build-and-push-docker.outputs.primary_ghcr_manifest_tag }}
          N8N_PC_TAG: ${{ needs.build-and-push-docker.outputs.n8n_pc_primary_ghcr_manifest_tag }}
          RUNNERS_TAG: ${{ needs.build-and-push-docker.outputs.runners_primary_ghcr_manifest_tag }}
          DISTROLESS_TAG: ${{ needs.build-and-push-docker.outputs.runners_distroless_primary_ghcr_manifest_tag }}
        run: node .github/scripts/docker/get-manifest-digests.mjs

  call-success-url:
    name: Call Success URL
    needs: [determine-build-context, build-app, build-and-push-docker, create_multi_arch_manifest]
    runs-on: ubuntu-latest
    if: |
      always() &&
      github.event_name == 'workflow_dispatch' &&
      github.event.inputs.success_url != '' &&
      needs.determine-build-context.result == 'success' &&
      needs.build-app.result == 'success' &&
      needs.build-and-push-docker.result == 'success' &&
      (needs.create_multi_arch_manifest.result == 'success' || needs.create_multi_arch_manifest.result == 'skipped')
    steps:
      - name: Call Success URL
        env:
          SUCCESS_URL: ${{ github.event.inputs.success_url }}
        run: |
          echo "Calling success URL: ${{ env.SUCCESS_URL }}"
          curl -v "${{ env.SUCCESS_URL }}" || echo "Failed to call success URL"
        shell: bash

  provenance-n8n:
    name: SLSA Provenance (n8n)
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      inputs.create_attestations &&
      needs.create_multi_arch_manifest.result == 'success' &&
      needs.create_multi_arch_manifest.outputs.n8n_digest != ''
    permissions:
      id-token: write
      packages: write
      actions: read
    # SLSA L3 Provenance - Must use version tags (@vX.Y.Z), NOT SHAs
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.create_multi_arch_manifest.outputs.n8n_image }}
      digest: ${{ needs.create_multi_arch_manifest.outputs.n8n_digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  provenance-n8n-pc:
    name: SLSA Provenance (n8n-pc)
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      inputs.create_attestations &&
      needs.create_multi_arch_manifest.result == 'success' &&
      needs.create_multi_arch_manifest.outputs.n8n_pc_digest != ''
    permissions:
      id-token: write
      packages: write
      actions: read
    # SLSA L3 Provenance - Must use version tags (@vX.Y.Z), NOT SHAs
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.create_multi_arch_manifest.outputs.n8n_pc_image }}
      digest: ${{ needs.create_multi_arch_manifest.outputs.n8n_pc_digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  provenance-runners:
    name: SLSA Provenance (runners)
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      inputs.create_attestations &&
      needs.create_multi_arch_manifest.result == 'success' &&
      needs.create_multi_arch_manifest.outputs.runners_digest != ''
    permissions:
      id-token: write
      packages: write
      actions: read
    # SLSA L3 Provenance - Must use version tags (@vX.Y.Z), NOT SHAs
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.create_multi_arch_manifest.outputs.runners_image }}
      digest: ${{ needs.create_multi_arch_manifest.outputs.runners_digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  provenance-runners-distroless:
    name: SLSA Provenance (runners-distroless)
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      inputs.create_attestations &&
      needs.create_multi_arch_manifest.result == 'success' &&
      needs.create_multi_arch_manifest.outputs.runners_distroless_digest != ''
    permissions:
      id-token: write
      packages: write
      actions: read
    # SLSA L3 Provenance - Must use version tags (@vX.Y.Z), NOT SHAs
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.create_multi_arch_manifest.outputs.runners_distroless_image }}
      digest: ${{ needs.create_multi_arch_manifest.outputs.runners_distroless_digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  # VEX Attestation - Documents which CVEs affect us (security/vex.openvex.json)
  vex-attestation:
    name: VEX Attestation
    needs:
      [
        determine-build-context,
        build-and-push-docker,
        create_multi_arch_manifest,
        provenance-n8n,
        provenance-n8n-pc,
        provenance-runners,
        provenance-runners-distroless,
      ]
    if: |
      always() &&
      inputs.create_attestations &&
      needs.create_multi_arch_manifest.result == 'success' &&
      (needs.determine-build-context.outputs.release_type == 'stable' ||
       needs.determine-build-context.outputs.release_type == 'rc' ||
       needs.determine-build-context.outputs.release_type == 'nightly')
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1

      # An empty document still gets signed and attached, and trivy still loads
      # it — so a statement lost to a typo'd purl or a stale pin degrades to a
      # silent no-op. Warn rather than fail: empty is a legitimate state when
      # nothing is currently suppressed.
      - name: Report VEX statement count
        run: |
          COUNT=$(node -e "process.stdout.write(String((require('./security/vex.openvex.json').statements ?? []).length))")
          echo "VEX statements: $COUNT"
          if [ "$COUNT" -eq 0 ]; then
            echo "::warning::VEX document has no statements - every published image will carry an attestation that suppresses nothing."
          fi

      - name: Login to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest VEX to n8n image
        if: needs.create_multi_arch_manifest.outputs.n8n_digest != ''
        run: |
          cosign attest --yes \
            --type openvex \
            --predicate security/vex.openvex.json \
            ${{ needs.create_multi_arch_manifest.outputs.n8n_image }}@${{ needs.create_multi_arch_manifest.outputs.n8n_digest }}

      - name: Attest VEX to n8n-pc image
        if: needs.create_multi_arch_manifest.outputs.n8n_pc_digest != ''
        run: |
          cosign attest --yes \
            --type openvex \
            --predicate security/vex.openvex.json \
            ${{ needs.create_multi_arch_manifest.outputs.n8n_pc_image }}@${{ needs.create_multi_arch_manifest.outputs.n8n_pc_digest }}

      - name: Attest VEX to runners image
        if: needs.create_multi_arch_manifest.outputs.runners_digest != ''
        run: |
          cosign attest --yes \
            --type openvex \
            --predicate security/vex.openvex.json \
            ${{ needs.create_multi_arch_manifest.outputs.runners_image }}@${{ needs.create_multi_arch_manifest.outputs.runners_digest }}

      - name: Attest VEX to runners-distroless image
        if: needs.create_multi_arch_manifest.outputs.runners_distroless_digest != ''
        run: |
          cosign attest --yes \
            --type openvex \
            --predicate security/vex.openvex.json \
            ${{ needs.create_multi_arch_manifest.outputs.runners_distroless_image }}@${{ needs.create_multi_arch_manifest.outputs.runners_distroless_digest }}

  # SBOM Attestation - one enriched, license-gated CycloneDX SBOM per image.
  # syft scans the image for OS and npm packages. enrich-sbom resolves first-party
  # and override licenses. check-sbom-licenses gates the npm components. cosign then
  # attests the result to the image digest, as it does for VEX and provenance.
  # The build sets oci-mediatypes on the exporter to get the OCI index format,
  # so BuildKit emits no SBOM. This job supplies the license data.
  sbom-attestation:
    name: SBOM Attestation
    needs:
      [
        determine-build-context,
        build-and-push-docker,
        create_multi_arch_manifest,
        provenance-n8n,
        provenance-n8n-pc,
        provenance-runners,
        provenance-runners-distroless,
      ]
    if: |
      always() &&
      inputs.create_attestations &&
      needs.create_multi_arch_manifest.result == 'success' &&
      (needs.determine-build-context.outputs.release_type == 'stable' ||
       needs.determine-build-context.outputs.release_type == 'rc' ||
       needs.determine-build-context.outputs.release_type == 'nightly')
    runs-on: blacksmith-4vcpu-ubuntu-2204
    timeout-minutes: 30
    permissions:
      id-token: write
      packages: write
    steps:
      - name: Checkout
        uses: useblacksmith/checkout@046e27863876319367379f972a0c394bee91aee1 # v1.4.0
        with:
          fetch-depth: 1
          persist-credentials: false

      # Nothing to install: syft replaced cdxgen, and the two license scripts have
      # no dependencies. This step only pins the Node version.
      - name: Setup Node.js
        uses: ./.github/actions/setup-nodejs
        with:
          build-command: ''
          install-command: ''
          # Scope the cache key: the default is the root lockfile, which would
          # restore the whole workspace pnpm store into a job that never runs pnpm.
          cache-dependency-path: .github/scripts/pnpm-lock.yaml

      # Pin the scanner, not just the action. cdxgen was pinned in a lockfile;
      # syft's default version rides the action release, so a SHA bump would
      # silently change what produces the signed SBOM. enrich-sbom.mjs depends
      # on two syft specifics — the `syft:location:0:path` property name and the
      # `UNKNOWN` version sentinel — so re-A/B against a real image when bumping.
      - name: Install Syft
        uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
        with:
          # Matches what this action SHA already defaults to, so pinning it
          # records the current behaviour rather than changing it.
          syft-version: v1.38.2

      - name: Install Cosign
        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1

      - name: Login to GHCR
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate, enrich, gate and attest SBOM per image
        env:
          N8N_IMAGE: ${{ needs.create_multi_arch_manifest.outputs.n8n_image }}
          N8N_DIGEST: ${{ needs.create_multi_arch_manifest.outputs.n8n_digest }}
          N8N_PC_IMAGE: ${{ needs.create_multi_arch_manifest.outputs.n8n_pc_image }}
          N8N_PC_DIGEST: ${{ needs.create_multi_arch_manifest.outputs.n8n_pc_digest }}
          RUNNERS_IMAGE: ${{ needs.create_multi_arch_manifest.outputs.runners_image }}
          RUNNERS_DIGEST: ${{ needs.create_multi_arch_manifest.outputs.runners_digest }}
          DISTROLESS_IMAGE: ${{ needs.create_multi_arch_manifest.outputs.runners_distroless_image }}
          DISTROLESS_DIGEST: ${{ needs.create_multi_arch_manifest.outputs.runners_distroless_digest }}
        run: node .github/scripts/attest-image-sbom.mjs

  security-scan:
    name: Security Scan
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      success() &&
      (needs.determine-build-context.outputs.release_type == 'stable' ||
       needs.determine-build-context.outputs.release_type == 'nightly' ||
       needs.determine-build-context.outputs.release_type == 'rc')
    uses: ./.github/workflows/security-trivy-scan-callable.yml
    with:
      image_ref: ${{ needs.build-and-push-docker.outputs.image_ref }}
    secrets: inherit

  security-scan-pc:
    name: Security Scan (n8n-pc)
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      success() &&
      needs.build-and-push-docker.outputs.n8n_pc_primary_ghcr_manifest_tag != '' &&
      (needs.determine-build-context.outputs.release_type == 'stable' ||
       needs.determine-build-context.outputs.release_type == 'nightly' ||
       needs.determine-build-context.outputs.release_type == 'rc')
    uses: ./.github/workflows/security-trivy-scan-callable.yml
    with:
      image_ref: ${{ needs.build-and-push-docker.outputs.n8n_pc_primary_ghcr_manifest_tag }}
    secrets: inherit

  security-scan-runners:
    name: Security Scan (runners)
    needs: [determine-build-context, build-and-push-docker, create_multi_arch_manifest]
    if: |
      success() &&
      (needs.determine-build-context.outputs.release_type == 'stable' ||
       needs.determine-build-context.outputs.release_type == 'nightly' ||
       needs.determine-build-context.outputs.release_type == 'rc')
    uses: ./.github/workflows/security-trivy-scan-callable.yml
    with:
      image_ref: ${{ needs.build-and-push-docker.outputs.runners_primary_ghcr_manifest_tag }}
    secrets: inherit

  notify-on-failure:
    name: Notify Cats on nightly build failure
    runs-on: ubuntu-latest
    needs:
      [
        determine-build-context,
        build-app,
        build-and-push-docker,
        create_multi_arch_manifest,
        security-scan,
        security-scan-pc,
        security-scan-runners,
      ]
    if: |
      always() && github.event_name == 'schedule' &&
      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          sparse-checkout: .github/scripts/slack
          sparse-checkout-cone-mode: false
      - name: Notify Slack
        env:
          SLACK_TOKEN: ${{ secrets.QBOT_SLACK_TOKEN }}
        run: |
          node .github/scripts/slack/notify.mjs \
            --channel '#team-catalysts' \
            --text 'Nightly Docker pipeline failed - ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'