name: publish-server-image

# Release tags publish the source-addressed image used by in-app updates plus the human-readable
# semver tags. Main publishes `edge`. Pull requests build with a read-only token and an isolated
# cache, so untrusted code can validate the images without receiving package-publish authority.
on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    paths:
      - ".dockerignore"
      - ".github/workflows/publish-server-image.yml"
      - "apps/**"
      - "infra/compose/**"
      - "infra/sandboxes/computer/**"
      - "infra/updater/**"
      - "packages/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
  workflow_dispatch:

permissions:
  contents: read

env:
  # docker/metadata-action otherwise truncates commit tags to seven collision-prone characters.
  DOCKER_METADATA_SHORT_SHA_LENGTH: 40

concurrency:
  group: publish-server-image-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate:
    name: Validate ${{ matrix.name }} image
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: app
            dockerfile: infra/compose/Dockerfile
            context: .
          - name: updater
            dockerfile: infra/updater/Dockerfile
            context: .
          - name: computer
            dockerfile: infra/sandboxes/computer/Dockerfile
            context: infra/sandboxes/computer
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ghcr.io/${{ github.repository }}/${{ matrix.name }}
          tags: type=sha,prefix=sha-
      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          push: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: ${{ matrix.name == 'app' && format('GIT_SHA={0}', github.sha) || '' }}
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=pr-${{ github.event.pull_request.number }}-${{ matrix.name }}
          provenance: false
          sbom: false

  publish:
    name: Publish ${{ matrix.name }} image
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    # QEMU arm64 is slow; keep everyday main→edge publishes at 90m. Multi-arch
    # (v* tags + workflow_dispatch) needs the longer budget.
    timeout-minutes: ${{ (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) && 180 || 90 }}
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        include:
          # Only the updater image contains the Docker CLI; the application image stays unprivileged.
          # The supervisor is not a separate published image: it runs from `app` on the internal network.
          - name: app
            dockerfile: infra/compose/Dockerfile
            context: .
          - name: updater
            dockerfile: infra/updater/Dockerfile
            context: .
          - name: computer
            dockerfile: infra/sandboxes/computer/Dockerfile
            context: infra/sandboxes/computer
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
        with:
          persist-credentials: false
      # Emulated arm64 only for releases and manual runs — not the ~10x/day main merge train.
      - if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: Log in to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          # A fork can publish only to its own namespace; no credential can redirect this value.
          images: ghcr.io/${{ github.repository }}/${{ matrix.name }}
          tags: |
            type=semver,pattern=v{{version}}
            type=semver,pattern=v{{major}}.{{minor}}
            type=sha,prefix=sha-
            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' }}
            # Stable releases only: a hyphen marks a prerelease (v1.0.0-rc.1) that must not move latest.
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
      - id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Main→edge stays native amd64. Tags and workflow_dispatch publish amd64+arm64.
          platforms: ${{ (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          # GET /health can report the exact source commit without a deployment-supplied override.
          build-args: ${{ matrix.name == 'app' && format('GIT_SHA={0}', github.sha) || '' }}
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}
          provenance: mode=max
          sbom: true
      - name: Attest the published image
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ghcr.io/${{ github.repository }}/${{ matrix.name }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true