docker.yml

name: Docker Build and Push

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    types:
      - opened
      - synchronize
      - reopened

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

env:
  REGISTRY: ghcr.io
  BACKEND_IMAGE: ghcr.io/${{ github.repository_owner }}/certamen-backend
  FRONTEND_IMAGE: ghcr.io/${{ github.repository_owner }}/certamen-frontend

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
      security-events: write

    strategy:
      matrix:
        component: [backend, frontend]

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Generate image tag
        id: tag
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          GITHUB_SHA: ${{ github.sha }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          # Format: {ref}-{short-sha}
          # e.g., main-5db1366 or pr-243-5db1366

          # Use head SHA for PRs (persistent), github.sha for branches
          if [ "$EVENT_NAME" == "pull_request" ]; then
            COMMIT_SHA="$PR_HEAD_SHA"
            REF="pr-${PR_NUMBER}"
          else
            COMMIT_SHA="$GITHUB_SHA"
            REF=$(echo "$REF_NAME" | sed 's/\//-/g')
          fi

          SHORT_SHA=$(echo "${COMMIT_SHA}" | cut -c1-7)

          TAG="${REF}-${SHORT_SHA}"
          {
            echo "value=${TAG}"
            echo "commit_sha=${COMMIT_SHA}"
            echo "short_sha=${SHORT_SHA}"
          } >> "$GITHUB_OUTPUT"
          echo "Generated image tag: ${TAG} (commit: ${COMMIT_SHA})"

      - name: Set image name
        id: image
        run: |
          if [ "${{ matrix.component }}" == "backend" ]; then
            echo "name=${{ env.BACKEND_IMAGE }}" >> "$GITHUB_OUTPUT"
          else
            echo "name=${{ env.FRONTEND_IMAGE }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build amd64 image for scanning
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: Dockerfile.${{ matrix.component }}
          platforms: linux/amd64
          push: false
          load: true
          tags: |
            ${{ steps.image.outputs.name }}:${{ steps.tag.outputs.value }}
          build-args: |
            VITE_APP_VERSION=${{ steps.tag.outputs.value }}
          cache-from: type=gha,scope=${{ matrix.component }}
          cache-to: type=gha,mode=max,scope=${{ matrix.component }}

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ steps.image.outputs.name }}:${{ steps.tag.outputs.value }}
          format: 'sarif'
          output: 'trivy-results-${{ matrix.component }}.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
        if: always()
        continue-on-error: true
        with:
          sarif_file: 'trivy-results-${{ matrix.component }}.sarif'
          category: 'trivy-${{ matrix.component }}'

      - name: Push image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: Dockerfile.${{ matrix.component }}
          platforms: linux/amd64
          push: true
          tags: |
            ${{ steps.image.outputs.name }}:${{ steps.tag.outputs.value }}
            ${{ steps.image.outputs.name }}:latest
          build-args: |
            VITE_APP_VERSION=${{ steps.tag.outputs.value }}
          cache-from: type=gha,scope=${{ matrix.component }}
          cache-to: type=gha,mode=max,scope=${{ matrix.component }}

      - name: Output image details
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          IMAGE_URL="${{ steps.image.outputs.name }}:${{ steps.tag.outputs.value }}"
          echo "::notice title=Docker Image (${{ matrix.component }})::Image pushed to ${IMAGE_URL}"
          {
            echo "Component: ${{ matrix.component }}"
            echo "Image: ${{ steps.image.outputs.name }}:${{ steps.tag.outputs.value }}"
            echo "Platform: linux/amd64"
            echo "Commit: ${{ steps.tag.outputs.commit_sha }}"
          } >> "$GITHUB_STEP_SUMMARY"