docker-publish.yml

name: Build and Push Docker Images

on:
  push:
    tags: ["v*"]
  pull_request:
    branches: [main]

env:
  REGISTRY: docker.io
  IMAGE_NAME: writenotenow/mysql-mcp

permissions:
  contents: read
  packages: write
  security-events: write # For security scanning
  pull-requests: write # For PR comments
  id-token: write # For supply chain attestations
  attestations: write # For generating attestations

jobs:
  # Quality gate - must pass before any builds
  quality-gate:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Type check
        run: npm run typecheck

      - name: Run tests
        run: npm test

  # Security gate - CodeQL must pass before any builds
  codeql:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Check for JS/TS files
        id: check-files
        run: |
          if find . -type f \( -name "*.js" -o -name "*.jsx" -o -name "*.ts" -o -name "*.tsx" -o -name "*.mjs" -o -name "*.cjs" \) | grep -q .; then
            echo "has_code=true" >> $GITHUB_OUTPUT
          else
            echo "has_code=false" >> $GITHUB_OUTPUT
          fi

      - name: Initialize CodeQL
        if: steps.check-files.outputs.has_code == 'true'
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
          queries: security-extended,security-and-quality

      - name: Autobuild
        if: steps.check-files.outputs.has_code == 'true'
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        if: steps.check-files.outputs.has_code == 'true'
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:javascript-typescript"

  # Build each platform on native architecture (avoids QEMU emulation issues)
  build-platform:
    needs: [quality-gate, codeql]
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm

    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write

    outputs:
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        continue-on-error: true
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Read version from VERSION file
        id: version
        run: |
          if [ -f "VERSION" ]; then
            VERSION=$(head -1 VERSION | tr -d '[:space:]')
          fi
          if [ -z "$VERSION" ]; then
            VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
          fi
          if [ -z "$VERSION" ]; then
            VERSION="1.0.0"
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Detected version: $VERSION"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=false
            suffix=-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          tags: |
            type=sha,prefix=sha-,format=short

      - name: Build and push platform image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.platform }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
          provenance: mode=max
          sbom: true

      - name: Export digest
        if: github.event_name != 'pull_request'
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v6
        with:
          name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # Security scan on amd64 image only (runs in parallel)
  security-scan:
    runs-on: ubuntu-latest
    needs: build-platform
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image for scanning
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64
          push: false
          load: true
          tags: local-scan:latest
          cache-from: type=gha,scope=linux/amd64

      - name: Docker Scout security scan
        timeout-minutes: 10
        run: |
          curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
          docker images local-scan:latest
          echo "🔍 Running Docker Scout security scan"
          if timeout 480 docker scout cves local-scan:latest --only-fixed --exit-code 2>&1 | tee scout_output.txt; then
            echo "✅ No fixable vulnerabilities detected"
          else
            SCOUT_EXIT=$?
            if [ "$SCOUT_EXIT" -eq 2 ]; then
              echo "❌ Fixable vulnerabilities detected — blocking deployment"
              cat scout_output.txt
              exit 1
            else
              echo "⚠️ Docker Scout scan failed or timed out (exit code: $SCOUT_EXIT)"
              cat scout_output.txt
            fi
          fi

  # Merge platform images into multi-arch manifest
  merge-and-push:
    runs-on: ubuntu-latest
    needs: [build-platform, security-scan]
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
      deployments: write

    environment:
      name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || '' }}
      url: https://hub.docker.com/r/writenotenow/mysql-mcp

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Download digests
        uses: actions/download-artifact@v7
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Read version
        id: version
        run: |
          if [ -f "VERSION" ]; then
            VERSION=$(head -1 VERSION | tr -d '[:space:]')
          fi
          if [ -z "$VERSION" ]; then
            VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
          fi
          if [ -z "$VERSION" ]; then
            VERSION="1.0.0"
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Extract metadata for manifest
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=auto
          tags: |
            type=semver,pattern=v{{version}}
            type=raw,value=v${{ steps.version.outputs.version }},enable={{is_default_branch}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,prefix=sha-,format=short

      - name: Create and push manifest
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect manifest
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}

      # Update Docker Hub description
      - name: Update Docker Hub Description
        if: startsWith(github.ref, 'refs/tags/')
        uses: peter-evans/dockerhub-description@v5
        continue-on-error: true
        timeout-minutes: 5
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
          repository: ${{ env.IMAGE_NAME }}
          readme-filepath: ./DOCKER_README.md
          short-description: "MySQL MCP Server: 192 Tools, Sandboxed Code Mode, Tool Filtering, Pooling, HTTP/SSE & OAuth 2.1."

      - name: Deployment Summary
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          echo "✅ Successfully published Docker images to production"
          echo "🐳 Registry: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          echo "🏷️ Tags: ${{ steps.meta.outputs.tags }}"
          echo "📝 Commit: ${{ github.sha }}"
          echo "👤 Published by: ${{ github.actor }}"