stagex.yml

name: stagex-build CI # build check for PR and main; push PR images to GHCR/ECR

# Cancel superseded runs for a given PR or branch
concurrency:
  cancel-in-progress: true
  group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}"

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  build:
    name: build ${{ matrix.name }}
    runs-on: ubicloud-standard-16
    strategy:
      # One job per image so builds/pushes run in parallel. Don't cancel the
      # other images if one fails.
      fail-fast: false
      matrix:
        name:
          - qos_client
          - qos_host
          - qos_host_qemu
          - qos_enclave
          - qos_enclave_egress
          - qos_bridge
          - qos_bridge_qemu
          - qos_bridge_egress
          - signed_echo
        include:
          - name: qos_client
            ghcr: ghcr.io/tkhq/qos_client
            ecr: true
          - name: qos_host
            ghcr: ghcr.io/tkhq/qos_host
            ecr: true
          - name: qos_host_qemu
            ghcr: ghcr.io/tkhq/qos_host_qemu
            ecr: false
          - name: qos_enclave
            ghcr: ghcr.io/tkhq/qos_enclave
            ecr: true
          - name: qos_enclave_egress
            ghcr: ghcr.io/tkhq/qos_enclave_egress
            ecr: true
          - name: qos_bridge
            ghcr: ghcr.io/tkhq/qos_bridge
            ecr: true
          - name: qos_bridge_qemu
            ghcr: ghcr.io/tkhq/qos_bridge_qemu
            ecr: false
          - name: qos_bridge_egress
            ghcr: ghcr.io/tkhq/qos_bridge_egress
            ecr: true
          # signed_echo is an example image with no ECR repository; GHCR only.
          - name: signed_echo
            ghcr: ghcr.io/tkhq/qos/examples/signed_echo
            ecr: false
    permissions:
      contents: read
      packages: write   # needed for pushing PR images to GHCR
      id-token: write   # needed for OIDC auth to assume the AWS role for ECR
    steps:
      - name: Checkout sources
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # Only authenticate to GHCR/ECR for PRs, since main is build-only.
      - name: Setup Docker
        uses: ./.github/actions/docker-setup
        with:
          ghcr: ${{ github.event_name == 'pull_request' && secrets.GITHUB_TOKEN || '' }}
          awsRegion: us-east-1
          awsRole: ${{ github.event_name == 'pull_request' && 'arn:aws:iam::799078726966:role/github-qos' || '' }}

      # Build only this matrix image (the `common` base is built as a dependency).
      - name: Run `make`
        shell: 'script -q -e -c "bash {0}"'
        run: make -j$(nproc) "out/${{ matrix.name }}/index.json"

      # Publish PR images so they can be deployed for testing; main is build-only.
      - name: Push PR image to GHCR and ECR
        if: github.event_name == 'pull_request'
        env:
          name: ${{ matrix.name }}
          ghcr_image: ${{ matrix.ghcr }}
          push_ecr: ${{ matrix.ecr }}
        run: |
          set -euo pipefail
          tag="pr-${{ github.event.number }}"
          ecr_registry="799078726966.dkr.ecr.us-east-1.amazonaws.com"

          # Load the freshly built OCI image into the local docker daemon.
          env -C "out/${name}" tar -cf - . | docker load

          pushed=()
          push_image() {
            # Push image:tag, stream the output, and record the immutable
            # registry URL (ref@sha256:digest).
            local ref="$1"
            docker push "${ref}" | tee /tmp/push.out
            local digest
            digest="$(sed -n 's/.*digest: \(sha256:[0-9a-f]\{64\}\).*/\1/p' /tmp/push.out | tail -1)"
            pushed+=("${ref}@${digest}")
          }

          # Push to GHCR
          docker tag "qos-local/${name}:latest" "${ghcr_image}:${tag}"
          push_image "${ghcr_image}:${tag}"

          # Push to ECR
          if [ "${push_ecr}" = "true" ]; then
            ecr_image="${ecr_registry}/tkhq/${name}"
            docker tag "qos-local/${name}:latest" "${ecr_image}:${tag}"
            push_image "${ecr_image}:${tag}"
          fi

          # Print the full image URL (with digest) for every repository pushed to.
          {
            echo "### Pushed \`${name}\` images"
            echo ""
            for ref in "${pushed[@]}"; do
              echo "- \`${ref}\`"
            done
          } | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"

  # Single aggregate check that branch protection can require (the matrix above
  # produces one check per image). Passes only if every image job succeeded.
  build-artifacts:
    name: build artifacts
    needs: build
    if: always()
    runs-on: ubicloud-standard-2
    steps:
      - name: Verify all image builds succeeded
        run: |
          result="${{ needs.build.result }}"
          if [ "${result}" != "success" ]; then
            echo "One or more image build jobs did not succeed (result: ${result})" >&2
            exit 1
          fi

  qemu-e2e:
    name: QEMU e2e with PR images
    if: github.event_name == 'pull_request'
    needs: build-artifacts
    uses: ./.github/workflows/qemu-e2e.yml
    with:
      enclave_image: ghcr.io/tkhq/qos_enclave_egress:pr-${{ github.event.number }}
      host_image: ghcr.io/tkhq/qos_host_qemu:pr-${{ github.event.number }}
      bridge_image: ghcr.io/tkhq/qos_bridge_qemu:pr-${{ github.event.number }}
      client_image: ghcr.io/tkhq/qos_client:pr-${{ github.event.number }}
      pivot_image: ghcr.io/tkhq/qos/examples/signed_echo:pr-${{ github.event.number }}
    secrets: inherit