docker-publish.yml

name: Docker Publish

# -----------------------------------------------------------------------------
# Performance optimization: Native multi-platform builds
# -----------------------------------------------------------------------------
# Previously, this workflow built both amd64 and arm64 in a single job using
# QEMU emulation. arm64 compilation under QEMU was extremely slow:
#   - Rust broker compile: 15.7 min (vs ~30s native)
#   - bun install + UI build: 9.3 min (vs ~54s native)
#   - Registry cache export: 6.8 min
#   - Total: ~37 min for the "Build and push" step alone
#
# Now we split into parallel native builds:
#   - amd64 builds natively on ubuntu-latest
#   - arm64 builds natively on ubuntu-24.04-arm (GitHub-hosted ARM runner)
#   - A merge job assembles the multi-arch manifest
# This reduces wall-clock time from ~43 min to ~11-13 min.
# -----------------------------------------------------------------------------

on:
  push:
    tags:
      - 'release/v*'
  workflow_call:
    inputs:
      version:
        description: 'Version to publish (without v prefix)'
        required: true
        type: string
      ref:
        description: 'Git ref (tag or branch) to checkout'
        required: false
        type: string
        # If not provided: when triggered by tag push, uses the tag automatically;
        # when called via workflow_call, defaults to the commit that triggered the workflow
    outputs:
      scout_policy_status:
        description: 'Docker Scout policy status (pass, fail, or error)'
        value: ${{ jobs.merge-and-publish.outputs.scout_policy_status }}
      scout_policy_exit_code:
        description: 'Exit code returned by docker scout policy'
        value: ${{ jobs.merge-and-publish.outputs.scout_policy_exit_code }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE_NAME_GHCR: ghcr.io/prizz/opencode-cloud-sandbox
  IMAGE_NAME_DOCKERHUB: ${{ vars.DOCKERHUB_USERNAME }}/opencode-cloud-sandbox

jobs:
  # ---------------------------------------------------------------------------
  # Job 1: Extract version and metadata for downstream jobs
  # ---------------------------------------------------------------------------
  prepare:
    name: Prepare metadata
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      version: ${{ steps.version.outputs.version }}
      oci_description: ${{ steps.oci-description.outputs.description }}
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}

      # NOTE: We parse the description label from the Dockerfile so the
      # multi-arch manifest annotation stays in sync and GHCR shows a description.
      # If you change the label format or quoting, update the extraction logic.
      - name: Extract OCI description
        id: oci-description
        run: |
          set -euo pipefail
          description="$(python3 scripts/extract-oci-description.py packages/core/src/docker/Dockerfile)"
          echo "description=${description}" >> "$GITHUB_OUTPUT"

      - name: Extract version
        id: version
        run: |
          # Use input if called via workflow_call, otherwise extract from tag
          if [ -n "${{ inputs.version }}" ]; then
            VERSION="${{ inputs.version }}"
          else
            TAG="${GITHUB_REF_NAME}"
            VERSION="${TAG#release/}"  # Remove release/ prefix if present
            VERSION="${VERSION#v}"     # Remove v prefix
          fi
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "Building version: ${VERSION}"

  # ---------------------------------------------------------------------------
  # Jobs 2+3: Build each platform natively and push by digest
  # ---------------------------------------------------------------------------
  # Each platform builds on its native runner (no QEMU emulation), pushes
  # a single-platform image by digest (no tag), and uploads the digest as
  # an artifact. The merge job assembles the multi-arch manifest from digests.
  #
  # This "push-by-digest" pattern is documented at:
  # https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
  build-platform:
    name: Build ${{ matrix.platform }}
    needs: [prepare]
    strategy:
      fail-fast: true
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            arch: amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write

    steps:
      - name: Free disk space
        run: |
          set -euo pipefail
          echo "Before:"
          df -h
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc || true
          sudo rm -rf /usr/local/share/boost || true
          sudo apt-get clean
          sudo rm -rf /var/lib/apt/lists/*
          sudo rm -rf "$AGENT_TOOLSDIRECTORY" || true
          docker system prune -af || true
          echo "After:"
          df -h

      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract Dockerfile from embedded location
        run: |
          cp packages/core/src/docker/Dockerfile .

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE_NAME_GHCR }}
            ${{ env.IMAGE_NAME_DOCKERHUB }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # Push a single-platform image by digest (no tag). The digest is used
      # by the merge job to assemble the final multi-arch manifest.
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        env:
          BUILDKIT_PROGRESS: plain
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            OPENCODE_CLOUD_VERSION=${{ needs.prepare.outputs.version }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: |
            org.opencontainers.image.description=${{ needs.prepare.outputs.oci_description }}
          sbom: true
          provenance: mode=max
          # push-by-digest pushes the image without tags; the merge job
          # attaches the version + latest tags to the multi-arch manifest.
          outputs: type=image,"name=${{ env.IMAGE_NAME_GHCR }},${{ env.IMAGE_NAME_DOCKERHUB }}",push-by-digest=true,name-canonical=true,push=true
          # Per-architecture cache scopes prevent cross-platform cache thrashing.
          # mode=min for registry cache: only cache final-stage layers to avoid
          # the costly 6+ minute full-layer export that mode=max incurs.
          # GHA cache provides intermediate layer caching within GitHub's infra.
          cache-from: |
            type=registry,ref=${{ env.IMAGE_NAME_GHCR }}:buildcache-${{ matrix.arch }}
            type=gha,scope=opencode-cloud-sandbox-${{ matrix.arch }},version=2
          cache-to: |
            type=registry,ref=${{ env.IMAGE_NAME_GHCR }}:buildcache-${{ matrix.arch }},mode=min
            type=gha,scope=opencode-cloud-sandbox-${{ matrix.arch }},mode=min,version=2

      # Export the image digest so the merge job can reference it.
      - name: Export digest
        run: |
          set -euo pipefail
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  # ---------------------------------------------------------------------------
  # Job 4: Merge per-platform images into multi-arch manifest + post-publish
  # ---------------------------------------------------------------------------
  # Downloads digests from both platform builds, creates a multi-arch manifest
  # tagged with version + latest on both GHCR and Docker Hub, then runs
  # Docker Scout analysis and updates the Docker Hub description.
  merge-and-publish:
    name: Merge Manifest & Publish
    needs: [prepare, build-platform]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      scout_policy_status: ${{ steps.scout-policy.outputs.status }}
      scout_policy_exit_code: ${{ steps.scout-policy.outputs.exit_code }}
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}

      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.IMAGE_NAME_GHCR }}
            ${{ env.IMAGE_NAME_DOCKERHUB }}
          tags: |
            type=semver,pattern={{version}},value=${{ needs.prepare.outputs.version }}
            type=raw,value=latest

      # Merge per-platform digests into a single multi-arch manifest and
      # tag it on both registries. The annotation ensures GHCR shows the
      # image description.
      - name: Create multi-arch manifest
        working-directory: /tmp/digests
        run: |
          set -euo pipefail
          echo "Digests to merge:"
          ls -la

          # Build the source image list from digest filenames
          SOURCES=$(printf '${{ env.IMAGE_NAME_GHCR }}@sha256:%s ' *)

          # Create and push multi-arch manifest to all tags on all registries.
          # docker/metadata-action outputs one tag per line; convert to -t flags.
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.meta.outputs.json }}') \
            --annotation 'index:org.opencontainers.image.description=${{ needs.prepare.outputs.oci_description }}' \
            ${SOURCES}

      - name: Inspect manifest
        run: |
          docker buildx imagetools inspect "${{ env.IMAGE_NAME_GHCR }}:${{ needs.prepare.outputs.version }}"

      - name: Docker Scout Quickview
        continue-on-error: true
        uses: docker/scout-action@v1
        with:
          command: quickview
          image: ${{ env.IMAGE_NAME_DOCKERHUB }}:${{ needs.prepare.outputs.version }}
          summary: true
          write-comment: false

      - name: Install Docker Scout CLI
        continue-on-error: true
        run: |
          set -euo pipefail
          curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh
          docker scout version

      - name: Evaluate Docker Scout Policy
        id: scout-policy
        continue-on-error: true
        run: |
          set -euo pipefail

          org="${IMAGE_NAME_DOCKERHUB%%/*}"
          if [[ -z "${org}" || "${org}" == "${IMAGE_NAME_DOCKERHUB}" ]]; then
            echo "Unable to resolve Docker Hub org from IMAGE_NAME_DOCKERHUB=${IMAGE_NAME_DOCKERHUB}" >&2
            echo "status=error" >> "${GITHUB_OUTPUT}"
            echo "exit_code=1" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          set +e
          docker scout policy \
            "${IMAGE_NAME_DOCKERHUB}:${{ needs.prepare.outputs.version }}" \
            --org "${org}" --exit-code
          scout_exit_code=$?
          set -e

          case "${scout_exit_code}" in
            0) scout_status="pass" ;;
            2) scout_status="fail" ;;
            *) scout_status="error" ;;
          esac

          echo "status=${scout_status}" >> "${GITHUB_OUTPUT}"
          echo "exit_code=${scout_exit_code}" >> "${GITHUB_OUTPUT}"

      - name: Summarize Docker Scout Policy
        if: always()
        env:
          VERSIONED_IMAGE: ${{ env.IMAGE_NAME_DOCKERHUB }}:${{ needs.prepare.outputs.version }}
          SCOUT_POLICY_STATUS: ${{ steps.scout-policy.outputs.status }}
          SCOUT_POLICY_EXIT_CODE: ${{ steps.scout-policy.outputs.exit_code }}
        run: |
          set -euo pipefail
          {
            echo "### Docker Scout Policy"
            echo "- Image: \`${VERSIONED_IMAGE}\`"
            echo "- Status: \`${SCOUT_POLICY_STATUS:-unknown}\`"
            echo "- Exit code: \`${SCOUT_POLICY_EXIT_CODE:-unknown}\`"
          } >> "${GITHUB_STEP_SUMMARY}"

      - name: Update Docker Hub description
        uses: peter-evans/dockerhub-description@v5
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: ${{ vars.DOCKERHUB_USERNAME }}/opencode-cloud-sandbox
          readme-filepath: packages/core/src/docker/README.dockerhub.md

      - name: Summary
        env:
          SCOUT_POLICY_STATUS: ${{ steps.scout-policy.outputs.status }}
          SCOUT_POLICY_EXIT_CODE: ${{ steps.scout-policy.outputs.exit_code }}
        run: |
          echo "## 🐳 Sandbox Docker Images Published" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ needs.prepare.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**GHCR (GitHub Container Registry):**" >> $GITHUB_STEP_SUMMARY
          echo "- https://github.com/pRizz/opencode-cloud/pkgs/container/opencode-cloud-sandbox" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ env.IMAGE_NAME_GHCR }}:${{ needs.prepare.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ env.IMAGE_NAME_GHCR }}:latest\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Docker Hub:**" >> $GITHUB_STEP_SUMMARY
          echo "- https://hub.docker.com/r/${{ vars.DOCKERHUB_USERNAME }}/opencode-cloud-sandbox" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ env.IMAGE_NAME_DOCKERHUB }}:${{ needs.prepare.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ env.IMAGE_NAME_DOCKERHUB }}:latest\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Platforms:** linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Docker Scout policy (non-blocking):** \`${SCOUT_POLICY_STATUS:-unknown}\` (exit \`${SCOUT_POLICY_EXIT_CODE:-unknown}\`)" >> $GITHUB_STEP_SUMMARY