internal-image.yml

name: Internal Image

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

jobs:
  publish:
    name: Build and publish CHEK image
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Refuse to overwrite immutable tag
        env:
          IMAGE_REF: ghcr.io/${{ github.repository }}:sha-${{ github.sha }}
        run: |
          if docker buildx imagetools inspect "${IMAGE_REF}" >/dev/null 2>inspect-error.log; then
            echo "::error::Immutable image tag already exists: ${IMAGE_REF}"
            exit 1
          fi
          if ! grep -Eiq 'manifest unknown|name unknown|not found' inspect-error.log; then
            cat inspect-error.log >&2
            echo "::error::Unable to prove immutable image tag is absent"
            exit 1
          fi

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=sha,prefix=sha-,format=long

      - name: Build and push image
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=codex-lb-internal
          cache-to: type=gha,mode=max,scope=codex-lb-internal

      - name: Verify immutable image receipt
        id: receipt
        env:
          IMAGE_REF: ghcr.io/${{ github.repository }}:sha-${{ github.sha }}
          EXPECTED_DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          [[ "${EXPECTED_DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]]
          manifest=$(docker buildx imagetools inspect "${IMAGE_REF}")
          actual_digest=$(awk '$1 == "Digest:" {print $2; exit}' <<<"${manifest}")
          [[ "${actual_digest}" == "${EXPECTED_DIGEST}" ]]
          grep -q 'Platform:[[:space:]]*linux/amd64' <<<"${manifest}"
          grep -q 'Platform:[[:space:]]*linux/arm64' <<<"${manifest}"
          receipt_path="${RUNNER_TEMP}/codex-lb-image-receipt.json"
          python3 - "${receipt_path}" <<'PY'
          import json
          import os
          import sys

          with open(sys.argv[1], "w", encoding="utf-8") as handle:
              json.dump(
                  {
                      "schema": "qk_codex_lb_internal_image_receipt_v1",
                      "repository": os.environ["GITHUB_REPOSITORY"],
                      "source_sha": os.environ["GITHUB_SHA"],
                      "image_ref": os.environ["IMAGE_REF"],
                      "digest": os.environ["EXPECTED_DIGEST"],
                      "platforms": ["linux/amd64", "linux/arm64"],
                  },
                  handle,
                  separators=(",", ":"),
                  sort_keys=True,
              )
              handle.write("\n")
          PY
          receipt_sha256=$(shasum -a 256 "${receipt_path}" | awk '{print $1}')
          {
            echo "source_digest=${actual_digest}"
            echo "receipt_path=${receipt_path}"
            echo "receipt_sha256=${receipt_sha256}"
          } >> "${GITHUB_OUTPUT}"

      - name: Upload immutable image receipt
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: codex-lb-image-receipt-${{ github.sha }}
          path: ${{ steps.receipt.outputs.receipt_path }}
          if-no-files-found: error
          retention-days: 30

      - name: Dispatch exact image to ops-bootstrap
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0
        with:
          token: ${{ secrets.GH_PAT }}
          repository: chekdata/ops-bootstrap
          event-type: codex-lb-image-published
          client-payload: >-
            {"source_sha":"${{ github.sha }}","source_digest":"${{ steps.build.outputs.digest }}","receipt_sha256":"${{ steps.receipt.outputs.receipt_sha256 }}"}