docker-build.yml

name: DEV - build & publish branch containers

on:
  workflow_dispatch:
    inputs:
      branch:
        description: "Branch to build (e.g. my-feature-branch)"
        type: string
        required: true
      containers:
        description: "Comma-separated container names to build, or 'all' for all containers"
        type: string
        default: "all"
      tag:
        description: "Custom image tag (optional, defaults to sanitized branch name)"
        type: string
        default: ""

env:
  REGISTRY: ghcr.io
  DEV_REGISTRY_PATH: ghcr.io/${{ github.repository_owner }}/

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    if: inputs.branch != 'main'
    outputs:
      containers: ${{ steps.detect.outputs.containers }}
      downstream_containers: ${{ steps.detect.outputs.downstream_containers }}
      image_tag: ${{ steps.detect.outputs.image_tag }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.branch }}

      - name: Detect containers to build
        id: detect
        run: |
          # Compute image tag from branch name unless an explicit tag was provided
          if [[ -n "${{ inputs.tag }}" ]]; then
            IMAGE_TAG="${{ inputs.tag }}"
          else
            IMAGE_TAG="dev-$(echo "${{ inputs.branch }}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9._-]/-/g')"
          fi
          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT

          INPUT="${{ inputs.containers }}"
          CHANGED=()
          if [[ "$INPUT" == "all" ]]; then
            for CI_JSON in containers/*/ci.json; do
              CHANGED+=("$(basename "$(dirname "$CI_JSON")")")
            done
          else
            while IFS= read -r CONTAINER; do
              CHANGED+=("$CONTAINER")
            done < <(echo "$INPUT" | tr ',' '\n' | sed 's/^ *//;s/ *$//')
          fi

          # Forward cascade: if a base container is selected, add its downstream containers
          for CONTAINER in "${CHANGED[@]}"; do
            DOWNSTREAM=$(jq -r '.downstream // [] | .[]' "containers/$CONTAINER/ci.json")
            for DS in $DOWNSTREAM; do
              if [[ ! " ${CHANGED[*]} " =~ " $DS " ]]; then
                echo "Cascading downstream: $DS depends on $CONTAINER"
                CHANGED+=("$DS")
              fi
            done
          done

          # Reverse cascade: if a downstream container is selected, add its parent so the
          # base image is always built fresh before the downstream container
          for CONTAINER in "${CHANGED[@]}"; do
            for CI_JSON in containers/*/ci.json; do
              PARENT=$(basename "$(dirname "$CI_JSON")")
              DS_LIST=$(jq -r '.downstream // [] | .[]' "$CI_JSON" 2>/dev/null)
              for DS in $DS_LIST; do
                if [[ "$DS" == "$CONTAINER" ]] && [[ ! " ${CHANGED[*]} " =~ " $PARENT " ]]; then
                  echo "Cascading upstream: $PARENT required by $CONTAINER"
                  CHANGED+=("$PARENT")
                fi
              done
            done
          done

          if [[ ${#CHANGED[@]} -eq 0 ]]; then
            echo "No containers to build"
            echo "containers=[]" >> $GITHUB_OUTPUT
            echo "downstream_containers=[]" >> $GITHUB_OUTPUT
            exit 0
          fi

          # Split into base and downstream containers.
          # A container is downstream if it appears in another container's downstream list.
          DOWNSTREAM_IN_BUILD=()
          for CONTAINER in "${CHANGED[@]}"; do
            DS_LIST=$(jq -r '.downstream // [] | .[]' "containers/$CONTAINER/ci.json" 2>/dev/null || true)
            for DS in $DS_LIST; do
              if [[ " ${CHANGED[*]} " =~ " $DS " ]] && [[ ! " ${DOWNSTREAM_IN_BUILD[*]} " =~ " $DS " ]]; then
                DOWNSTREAM_IN_BUILD+=("$DS")
              fi
            done
          done

          BASE_CONTAINERS=()
          for CONTAINER in "${CHANGED[@]}"; do
            if [[ ! " ${DOWNSTREAM_IN_BUILD[*]} " =~ " $CONTAINER " ]]; then
              BASE_CONTAINERS+=("$CONTAINER")
            fi
          done

          echo "Base containers: ${BASE_CONTAINERS[*]}"
          echo "Downstream containers: ${DOWNSTREAM_IN_BUILD[*]}"

          echo "containers=$(printf '%s\n' "${BASE_CONTAINERS[@]}" | jq -R . | jq -sc .)" >> $GITHUB_OUTPUT
          if [[ ${#DOWNSTREAM_IN_BUILD[@]} -eq 0 ]]; then
            echo "downstream_containers=[]" >> $GITHUB_OUTPUT
          else
            echo "downstream_containers=$(printf '%s\n' "${DOWNSTREAM_IN_BUILD[@]}" | jq -R . | jq -sc .)" >> $GITHUB_OUTPUT
          fi

  build:
    needs: [ detect-changes ]
    if: needs.detect-changes.outputs.containers != '[]'
    runs-on: ubuntu-24.04-arm
    env:
      PYTHON_VERSION: "3.13"
      TASKFILE_VERSION: "3.45.4"
    strategy:
      fail-fast: false
      matrix:
        container: ${{ fromJson(needs.detect-changes.outputs.containers) }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.branch }}

      - name: Set up Python
        if: matrix.container == 'python-apps-base'
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install and build library
        if: matrix.container == 'python-apps-base'
        env:
          PUBLIC_IMAGE_REGISTRY_BASE: ${{ env.DEV_REGISTRY_PATH }}
        run: |
          pip install go-task-bin==${{ env.TASKFILE_VERSION }}
          task init:ci
          task build-dev
          cp ./dist/arduino*.whl ./containers/python-apps-base/

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v4

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          tags: |
            type=raw,value=${{ needs.detect-changes.outputs.image_tag }}
            type=raw,value=${{ needs.detect-changes.outputs.image_tag }}-${{ github.run_number }}
          images: ghcr.io/${{ github.repository_owner }}/app-bricks/${{ matrix.container }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: ./containers/${{ matrix.container }}
          file: ./containers/${{ matrix.container }}/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false
          build-args: |
            REGISTRY=${{ env.DEV_REGISTRY_PATH }}

  build-downstream:
    needs: [ detect-changes, build ]
    if: needs.detect-changes.outputs.downstream_containers != '[]'
    runs-on: ubuntu-24.04-arm
    env:
      PYTHON_VERSION: "3.13"
      TASKFILE_VERSION: "3.45.4"
    strategy:
      fail-fast: false
      matrix:
        container: ${{ fromJson(needs.detect-changes.outputs.downstream_containers) }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.branch }}

      - name: Set up Python
        if: matrix.container == 'python-apps-base'
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install and build library
        if: matrix.container == 'python-apps-base'
        env:
          PUBLIC_IMAGE_REGISTRY_BASE: ${{ env.DEV_REGISTRY_PATH }}
          DEV_TAG_VERSION: ${{ needs.detect-changes.outputs.image_tag }}
        run: |
          pip install go-task-bin==${{ env.TASKFILE_VERSION }}
          task init:ci
          task build-dev
          cp ./dist/arduino*.whl ./containers/python-apps-base/

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v4

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          tags: |
            type=raw,value=${{ needs.detect-changes.outputs.image_tag }}
            type=raw,value=${{ needs.detect-changes.outputs.image_tag }}-${{ github.run_number }}
          images: ghcr.io/${{ github.repository_owner }}/app-bricks/${{ matrix.container }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: ./containers/${{ matrix.container }}
          file: ./containers/${{ matrix.container }}/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false
          build-args: |
            REGISTRY=${{ env.DEV_REGISTRY_PATH }}
            BASE_IMAGE_VERSION=${{ needs.detect-changes.outputs.image_tag }}