python-ci-build.yml

name: Build and Release Python

# Multi-stage Docker Build Support:
# This workflow supports building multiple containers from a single multi-stage Dockerfile.
# To use this feature, provide a comma-separated list of container names via the 'container_names' input.
# 
# Example usage:
#   container_names: "api-server,mcp-server,community-worker"
#
# Each container will be built with the corresponding target stage and published as separate packages:
#   - ghcr.io/repo-api-server:v1.0.0
#   - ghcr.io/repo-mcp-server:v1.0.0  
#   - ghcr.io/repo-community-worker:v1.0.0
#
# All containers share the same version/tag but are published as separate packages.
# If container_names is not provided, the workflow builds a single container without a target stage.

on:
  workflow_call:
    inputs:
      python_version:
        required: false
        type: string
        default: '3.11'
      skip_ci:
        required: false
        type: boolean
        default: false
      skip_tests:
        required: false
        type: boolean
        default: true
      skip_security_scan:
        required: false
        type: boolean
        default: true
      commit_sha:
        required: true
        type: string
      docker_image_scanning:
        required: false
        type: boolean
        default: true
      install_dev_dependencies:
        required: false
        type: boolean
        default: true
      container_names:
        required: false
        type: string
        description: 'Comma-separated list of container names for multi-stage builds (e.g., "api-server,mcp-server,community-worker")'

permissions:
  contents: write
  packages: write
  security-events: write

jobs:
  validate-commit:
    name: 'Validate Commit'
    runs-on: ubuntu-latest
    outputs:
      is_merge_commit: ${{ steps.check_merge_commit.outputs.is_merge_commit }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.commit_sha }}
          fetch-depth: 2

      - id: check_merge_commit
        name: Check if merge commit
        run: |
          PARENT_COUNT=$(git cat-file -p HEAD | grep '^parent ' | wc -l)
          if [ $PARENT_COUNT -gt 1 ]; then
            echo "is_merge_commit=true" >> $GITHUB_OUTPUT
          else
            echo "is_merge_commit=false" >> $GITHUB_OUTPUT
          fi

  python-ci:
    name: 'Python CI'
    runs-on: ubuntu-latest
    needs: validate-commit
    if: ${{ !inputs.skip_ci }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.commit_sha }}

      - name: Set up Python ${{ inputs.python_version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Install UV
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Install Python dependencies
        run: |
          if [ "${{ inputs.install_dev_dependencies }}" = "true" ]; then
            uv sync --extra dev
          else
            uv sync
          fi

      # - name: Run Python checks
      #   run: |
      #     uv run ruff check
      #     uv run pyright .
      #     if [ "${{ inputs.skip_tests }}" = "false" ]; then
      #       uv run pytest || if [ $? -eq 5 ]; then echo "No tests found"; else exit $?; fi
      #     fi
      #     if [ "${{ inputs.skip_security_scan }}" = "false" ]; then
      #       uv run bandit -r . -f json -o bandit-report.json
      #     fi

  prepare-matrix:
    name: 'Prepare Build Matrix'
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - id: set-matrix
        name: Set matrix
        run: |
          if [ -n "${{ inputs.container_names }}" ]; then
            # Convert comma-separated list to JSON array
            containers=$(echo "${{ inputs.container_names }}" | tr ',' '\n' | sed 's/^/"/;s/$/"/' | paste -sd, -)
            echo "matrix={\"container\":[$containers]}" >> $GITHUB_OUTPUT
          else
            echo "matrix={\"container\":[\"\"]}" >> $GITHUB_OUTPUT
          fi

  build-and-publish:
    name: 'Build and Publish'
    runs-on: ubuntu-latest
    needs: [validate-commit, python-ci, prepare-matrix]
    if: ${{ always() && (inputs.skip_ci || needs.python-ci.result == 'success') }}
    strategy:
      matrix: ${{ fromJson(needs.prepare-matrix.outputs.matrix) }}
    outputs:
      image_tag: ${{ steps.get_tag.outputs.image_tag }}
      image_digest: ${{ steps.docker_push.outputs.digest }}
      container_tags: ${{ steps.collect_tags.outputs.container_tags }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python ${{ inputs.python_version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Install UV
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Install Python dependencies
        run: |
          if [ "${{ inputs.install_dev_dependencies }}" = "true" ]; then
            uv sync --extra dev
          else
            uv sync
          fi

      - id: get_tag
        name: Get Git Tag
        run: |
          # Check if the current commit has a tag
          TAG=$(git describe --tags --exact-match ${{ inputs.commit_sha }} 2>/dev/null || echo "")
          if [ -n "$TAG" ]; then
            echo "image_tag=$TAG" >> $GITHUB_OUTPUT
          else
            # Use short commit hash if no tag
            SHORT_SHA=$(echo ${{ inputs.commit_sha }} | cut -c1-7)
            echo "image_tag=main-${SHORT_SHA}" >> $GITHUB_OUTPUT
          fi

      - name: Python Semantic Release
        if: ${{ needs.validate-commit.outputs.is_merge_commit == 'false' }}
        run: uv run semantic-release version
        env:
          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_TOKEN }}

      - id: docker_push
        name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ matrix.container != '' && format('ghcr.io/{0}-{1}:{2}', github.repository, matrix.container, steps.get_tag.outputs.image_tag) || format('ghcr.io/{0}:{1}', github.repository, steps.get_tag.outputs.image_tag) }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: ${{ matrix.container != '' && matrix.container || '' }}

      - id: collect_tags
        name: Collect container tags
        run: |
          if [ -n "${{ matrix.container }}" ]; then
            echo "container_tags=${{ steps.get_tag.outputs.image_tag }}" >> $GITHUB_OUTPUT
          else
            echo "container_tags=${{ steps.get_tag.outputs.image_tag }}" >> $GITHUB_OUTPUT
          fi

  scan-image:
    name: 'Scan Docker Image'
    runs-on: ubuntu-latest
    needs: [build-and-publish, prepare-matrix]
    if: ${{ inputs.docker_image_scanning && always() && needs.build-and-publish.result == 'success' }}
    continue-on-error: true
    strategy:
      matrix: ${{ fromJson(needs.prepare-matrix.outputs.matrix) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.commit_sha }}

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GHCR_TOKEN }}

      - name: Generate image reference for scanning
        id: scan_image
        run: |
          # Check if the current commit has a tag
          TAG=$(git describe --tags --exact-match ${{ inputs.commit_sha }} 2>/dev/null || echo "")
          if [ -n "$TAG" ]; then
            IMAGE_TAG="$TAG"
          else
            # Use short commit hash if no tag
            SHORT_SHA=$(echo ${{ inputs.commit_sha }} | cut -c1-7)
            IMAGE_TAG="main-${SHORT_SHA}"
          fi
          
          # Generate image reference based on container type
          if [ -n "${{ matrix.container }}" ]; then
            echo "image_ref=ghcr.io/${{ github.repository }}-${{ matrix.container }}:${IMAGE_TAG}" >> $GITHUB_OUTPUT
          else
            echo "image_ref=ghcr.io/${{ github.repository }}:${IMAGE_TAG}" >> $GITHUB_OUTPUT
          fi

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        #continue-on-error: true
        with:
          image-ref: '${{ steps.scan_image.outputs.image_ref }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          security: 'CRITICAL'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        continue-on-error: true
        with:
          sarif_file: 'trivy-results.sarif'

  branch-mapping:
    name: 'Branch to Environment'
    runs-on: ubuntu-latest
    outputs:
      environment: ${{ steps.environment.outputs.environment }}
    steps:
      - name: Branch Mapping
        id: environment
        run: |
          if [ "${{ github.ref }}" = "refs/heads/develop" ]; then
            echo "environment=devnet" >> "$GITHUB_OUTPUT"
          elif [ "${{ github.ref }}" = "refs/heads/main" ] || [ "${{ github.ref }}" = "refs/heads/master" ]; then
            echo "environment=testnet" >> "$GITHUB_OUTPUT"
          else
            echo "::error::Unsupported branch"
            exit 1
          fi

  release-ixoworld-workaround:
    name: 'Release Helm Chart(s)'
    needs: [build-and-publish, scan-image, branch-mapping]
    if: github.repository_owner == 'ixoworld' && (always() && needs.build-and-publish.result == 'success' && (needs.scan-image.result == 'success' || needs.scan-image.result == 'skipped' || needs.scan-image.result == 'failure'))
    uses: ixoworld/ixo-github-actions/.github/workflows/node-ci-deploy.yml@main
    secrets: inherit
    with:
      environment: ${{ needs.branch-mapping.outputs.environment }}
      version: ${{ needs.build-and-publish.outputs.image_tag }}

  release-helm:
    name: 'Release Helm Chart'
    needs: [build-and-publish, scan-image, branch-mapping]
    if: github.repository_owner == 'ixofoundation' && (always() && needs.build-and-publish.result == 'success' && (needs.scan-image.result == 'success' || needs.scan-image.result == 'skipped' || needs.scan-image.result == 'failure'))
    uses: ixofoundation/ixo-github-actions/.github/workflows/node-ci-deploy.yml@main
    secrets: inherit
    with:
      environment: ${{ needs.branch-mapping.outputs.environment }}
      version: ${{ needs.build-and-publish.outputs.image_tag }}

# Notes for Deployment
# TestNet will be deployed using the latest release image ^
# Main will require deployment review and if approved use the latest release image ^