docker.yml

name: Docker Build and Publish

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]
    paths:
      - 'Dockerfile'
      - 'docker-compose.yml'
      - '.dockerignore'
      - 'src/**'
      - 'main.py'
      - 'pyproject.toml'
      - 'uv.lock'
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

permissions:
  contents: read
  packages: write
  security-events: write

jobs:
  docker-build-test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64,amd64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Test Docker build (AMD64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          push: false
          tags: authlete-mcp:test-amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      - name: Test Docker build (ARM64)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/arm64
          push: false
          tags: authlete-mcp:test-arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      - name: Test container startup (AMD64 only)
        run: |
          echo "Testing container startup on AMD64 platform..."

          # Build the image locally for AMD64 only (for testing)
          docker build -t authlete-mcp:test --platform linux/amd64 .

          # Test Python environment and module imports
          echo "Testing Python environment..."
          docker run --rm --platform linux/amd64 --entrypoint="" authlete-mcp:test /usr/bin/python3.11 -c "
          import sys
          print('✅ Python version:', sys.version)
          print('✅ Platform:', sys.platform)

          # Test essential package imports
          packages = ['duckdb', 'pydantic', 'httpx', 'mcp']
          for pkg in packages:
              try:
                  __import__(pkg)
                  print(f'✅ {pkg}: OK')
              except ImportError as e:
                  print(f'❌ {pkg}: {e}')
                  sys.exit(1)

          # Test application modules
          try:
              import src.authlete_mcp.server
              import src.authlete_mcp.tools.service_tools
              import src.authlete_mcp.tools.client_tools
              print('✅ All application modules imported successfully')
          except Exception as e:
              print(f'❌ Module import error: {e}')
              sys.exit(1)
          "

          # Test actual container startup (with timeout)
          echo "Testing container startup with MCP server..."
          timeout 10s docker run --rm --platform linux/amd64 \
            -e ORGANIZATION_ACCESS_TOKEN="dummy_token" \
            -e ORGANIZATION_ID="test_org" \
            authlete-mcp:test 2>&1 | tee startup_log.txt &

          # Wait for the process to start and check logs
          sleep 3

          if grep -q "Starting Authlete MCP Server" startup_log.txt; then
            echo "✅ Container starts successfully and shows expected log message"
          elif grep -q "INFO:" startup_log.txt; then
            echo "✅ Container starts successfully with INFO logs"
          else
            echo "⚠️ Container startup check completed (may need valid credentials for full startup)"
          fi

      - name: Check image size
        run: |
          echo "Checking Docker image size..."
          if docker images authlete-mcp:test --format "table {{.Size}}" | tail -n 1 > /dev/null 2>&1; then
            IMAGE_SIZE=$(docker images authlete-mcp:test --format "table {{.Size}}" | tail -n 1)
            echo "📏 Docker image size (AMD64): $IMAGE_SIZE"
          else
            echo "📏 Cross-platform images built successfully (size check skipped for multi-arch)"
          fi

      - name: Test Docker Compose
        run: |
          echo "Testing Docker Compose configuration..."

          # Create a dummy .env file for testing
          cat > .env << EOF
          ORGANIZATION_ACCESS_TOKEN=dummy_token_for_testing
          ORGANIZATION_ID=12345
          EOF

          # Test docker-compose configuration
          docker compose config --quiet

          echo "✅ Docker Compose configuration is valid"

  docker-publish:
    runs-on: ubuntu-latest
    needs: docker-build-test
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64,amd64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      - name: Generate deployment summary
        run: |
          echo "## Docker Image Published" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Registry:** ${{ env.REGISTRY }}" >> $GITHUB_STEP_SUMMARY
          echo "**Image:** ${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
          echo "**Tags:**" >> $GITHUB_STEP_SUMMARY
          echo '${{ steps.meta.outputs.tags }}' | while read tag; do
            echo "- \`$tag\`" >> $GITHUB_STEP_SUMMARY
          done
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Platforms:** linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Usage" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
          echo "# Pull the image (supports both AMD64 and ARM64)" >> $GITHUB_STEP_SUMMARY
          echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "# Run with environment variables" >> $GITHUB_STEP_SUMMARY
          echo "docker run -it --rm \\" >> $GITHUB_STEP_SUMMARY
          echo "  -e ORGANIZATION_ACCESS_TOKEN=\\\$YOUR_TOKEN \\" >> $GITHUB_STEP_SUMMARY
          echo "  ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "# For specific platform (optional)" >> $GITHUB_STEP_SUMMARY
          echo "docker run --platform linux/arm64 -it --rm \\" >> $GITHUB_STEP_SUMMARY
          echo "  -e ORGANIZATION_ACCESS_TOKEN=\\\$YOUR_TOKEN \\" >> $GITHUB_STEP_SUMMARY
          echo "  ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  docker-security-scan:
    runs-on: ubuntu-latest
    needs: docker-build-test
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64,amd64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Build image for scanning (AMD64 only)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          load: true
          tags: authlete-mcp:scan
          cache-from: type=gha

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'authlete-mcp:scan'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Display Trivy scan results
        if: always()
        run: |
          echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ -f trivy-results.sarif ]; then
            echo "✅ Trivy vulnerability scan completed successfully" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**SARIF file generated**: \`trivy-results.sarif\`" >> $GITHUB_STEP_SUMMARY

            # Run Trivy again in table format for summary display
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v $(pwd):/workspace aquasec/trivy:latest image \
              --format table --exit-code 0 authlete-mcp:scan >> trivy-summary.txt 2>&1 || true
            if [ -f trivy-summary.txt ]; then
              echo "" >> $GITHUB_STEP_SUMMARY
              echo "### Vulnerability Summary:" >> $GITHUB_STEP_SUMMARY
              echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
              head -50 trivy-summary.txt >> $GITHUB_STEP_SUMMARY
              echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
            fi
          else
            echo "❌ SARIF file not found" >> $GITHUB_STEP_SUMMARY
          fi

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        # Only upload SARIF in main branch pushes due to security-events permission requirements
        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
        with:
          sarif_file: 'trivy-results.sarif'