docker.yml

name: Docker Build and Push

on:
  push:
    branches: [main]
    tags:
      - 'v*'
  pull_request:
    branches: [main]

# Cancel superseded PR runs; let main/tag builds finish (they push images).
concurrency:
  group: docker-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions: {}

env:
  REGISTRY: ghcr.io

jobs:
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      apps: ${{ steps.apps.outputs.apps }}
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6

      - name: Filter changed paths
        id: filter
        # Tag pushes have no base ref to diff against, so always-build is the
        # safe default (a tag means we want to release both images).
        if: github.event_name != 'push' || github.ref_type != 'tag'
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        with:
          filters: |
            gearbox:
              - 'gearbox/**'
              - '.github/workflows/docker.yml'
            gearbox-agent:
              - 'gearbox-agent/**'
              - '.github/workflows/docker.yml'

      - name: Build matrix from filter results
        id: apps
        env:
          IS_TAG: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
          GEARBOX: ${{ steps.filter.outputs.gearbox }}
          AGENT: ${{ steps.filter.outputs.gearbox-agent }}
        run: |
          if [ "$IS_TAG" = "true" ]; then
            echo 'apps=["gearbox","gearbox-agent"]' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          apps=()
          [ "$GEARBOX" = "true" ] && apps+=("gearbox")
          [ "$AGENT" = "true" ] && apps+=("gearbox-agent")
          if [ ${#apps[@]} -eq 0 ]; then
            echo "apps=[]" >> "$GITHUB_OUTPUT"
          else
            printf -v joined '"%s",' "${apps[@]}"
            echo "apps=[${joined%,}]" >> "$GITHUB_OUTPUT"
          fi

  build-and-push:
    name: Build and Push (${{ matrix.app }})
    needs: changes
    if: needs.changes.outputs.apps != '[]'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        app: ${{ fromJSON(needs.changes.outputs.apps) }}

    env:
      IMAGE_NAME: ${{ github.repository }}/${{ matrix.app }}

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha,prefix=sha-
            type=raw,value=latest,enable={{is_default_branch}}

      # Build amd64-only locally so we can scan it before deciding to push.
      # Cache is shared with the multi-platform push step below, so the
      # incremental cost of the second build is essentially zero.
      - name: Build image for scan
        id: scan-build
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v6
        with:
          context: ./${{ matrix.app }}
          push: false
          load: true
          tags: ${{ matrix.app }}:scan
          cache-from: type=gha,scope=${{ matrix.app }}
          cache-to: type=gha,mode=max,scope=${{ matrix.app }}
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT_SHA=${{ github.sha }}
            BUILD_DATE=${{ github.event.repository.updated_at }}

      # Gating scan: fail the build on CRITICAL/HIGH unfixed-or-fixed in
      # production releases, but only warn on PRs (so authors can iterate
      # without being blocked by upstream-only CVEs).
      - name: Run Trivy image scan (gating)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ matrix.app }}:scan
          format: 'sarif'
          output: 'trivy-image-results.sarif'
          severity: 'CRITICAL,HIGH'
          ignore-unfixed: true
          exit-code: ${{ github.event_name == 'pull_request' && '0' || '1' }}

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
        if: always()
        with:
          sarif_file: 'trivy-image-results.sarif'
          category: trivy-docker-${{ matrix.app }}

      - name: Log in to Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Multi-platform build + push, only after the scan has passed. Reuses
      # the cache from the scan build so amd64 layers are essentially free.
      - name: Build and push (multi-platform)
        id: push
        if: github.event_name != 'pull_request'
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v6
        with:
          context: ./${{ matrix.app }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.app }}
          cache-to: type=gha,mode=max,scope=${{ matrix.app }}
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT_SHA=${{ github.sha }}
            BUILD_DATE=${{ github.event.repository.updated_at }}
          platforms: linux/amd64,linux/arm64

      - name: Generate artifact attestation
        if: github.event_name != 'pull_request' && !github.event.repository.private
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  docker-status:
    name: Docker Status
    needs: [changes, build-and-push]
    if: always()
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Verify required jobs succeeded or skipped intentionally
        env:
          CHANGES: ${{ needs.changes.result }}
          BUILD: ${{ needs.build-and-push.result }}
        run: |
          fail=0
          for job in CHANGES BUILD; do
            result="${!job}"
            case "$result" in
              success|skipped) ;;
              *) echo "::error::Job $job ended with result: $result"; fail=1 ;;
            esac
          done
          exit $fail