docker-build-publish.yml

# Docker Build & Publish
#
# This workflow builds and publishes multi-architecture Docker images:
# - Builds for amd64 and arm64 (Raspberry Pi support)
# - Scans images for vulnerabilities using Trivy
# - Publishes to GitHub Container Registry (ghcr.io)
# - Creates both versioned tags and 'latest' tag
#
# Runs on:
# - Push to main branch (publishes latest)
# - Version tags (v*.*.* - publishes versioned release)
# - Pull requests to main (build and test only, no publish)
# - Manual trigger via workflow_dispatch
#
# Image published to: ghcr.io/chiefgyk3d/stream-daemon

name: Docker Build & Publish

on:
  push:
    branches: [ main ]
    tags:
      - 'v*.*.*'
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  # Convert repository name to lowercase for Docker compatibility
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-test:
    name: Build and Test Docker Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write  # Required for uploading SARIF results
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v6
    
    - name: Set lowercase image name
      id: image-name
      run: echo "value=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Container Registry
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v6
      with:
        images: ${{ env.REGISTRY }}/${{ steps.image-name.outputs.value }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=sha
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build Docker image
      uses: docker/build-push-action@v6
      with:
        context: .
        file: ./Docker/Dockerfile
        push: false
        load: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        no-cache: true

    - name: Test Docker image
      run: |
        # Test that the image runs without errors (quick startup test)
        # Use the first tag from the list (should be the branch/PR tag)
        IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1)
        echo "Testing image: $IMAGE_TAG"
        docker run --rm "$IMAGE_TAG" python -c "import stream_daemon; print('Import successful')"

    - name: Scan image with Trivy
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH'
      continue-on-error: true  # Don't fail the build if Trivy has issues

    - name: Upload Trivy results to GitHub Security
      uses: github/codeql-action/upload-sarif@v4
      if: always() && hashFiles('trivy-results.sarif') != ''
      with:
        sarif_file: 'trivy-results.sarif'

    - name: Push Docker image
      if: github.event_name != 'pull_request'
      uses: docker/build-push-action@v6
      with:
        context: .
        file: ./Docker/Dockerfile
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: linux/amd64,linux/arm64
        no-cache: true

  docker-hub-publish:
    name: Publish to Docker Hub
    runs-on: ubuntu-latest
    needs: build-test
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
    permissions:
      contents: read
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Check Docker Hub credentials
      id: check-credentials
      run: |
        if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
          echo "skip=true" >> $GITHUB_OUTPUT
          echo "⚠️ Docker Hub credentials not configured - skipping Docker Hub publish"
        else
          echo "skip=false" >> $GITHUB_OUTPUT
          echo "✅ Docker Hub credentials found"
        fi

    - name: Log in to Docker Hub
      if: steps.check-credentials.outputs.skip != 'true'
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Extract metadata for Docker Hub
      if: steps.check-credentials.outputs.skip != 'true'
      id: meta
      uses: docker/metadata-action@v6
      with:
        images: ${{ secrets.DOCKERHUB_USERNAME }}/stream-daemon
        tags: |
          type=ref,event=branch
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push to Docker Hub
      if: steps.check-credentials.outputs.skip != 'true'
      uses: docker/build-push-action@v6
      with:
        context: .
        file: ./Docker/Dockerfile
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
        platforms: linux/amd64,linux/arm64