dev.yml

name: Create dev Docker image

on:
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME:  ${{ github.repository }}
  DOCKERHUB_USER: codecat

jobs:
  tests:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    services:
      mongo:
        image: mongo:5
        env:
          MONGO_INITDB_ROOT_USERNAME: chat
          MONGO_INITDB_ROOT_PASSWORD: chat
        options: >-
          --health-cmd mongo
          --health-interval 20s
          --health-timeout 10s
          --health-retries 5
        ports:
          - 27017:27017
    env:
      NODE_ENV: 'test'
      DATABASE_URL: 'mongodb://chat:chat@localhost:27017/tests?authSource=admin'
    steps:
    - uses: actions/checkout@v3
    - uses: denoland/setup-deno@v2
      with:
        deno-version: '2.9.4'
    - run: deno install --allow-scripts
    - name: Install Socket Firewall
      uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f
      with:
        mode: firewall-free
    - name: Install frontend dependencies
      working-directory: app
      run: |
        corepack enable
        sfw pnpm install --frozen-lockfile
    - name: Frontend lint
      working-directory: app
      run: pnpm lint
    - run: deno task migrate:tests
    - run: deno task check

  # Build each architecture on its own native runner (no QEMU emulation) and
  # push by digest; the manifest list is assembled in merge-image.
  build-image:
    needs: tests
    permissions: write-all
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Prepare
        run: |
          platform=${{ matrix.platform }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: ${{ matrix.platform }}
          build-args: |
            APP_VERSION=build-${{ github.run_number }}
          cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
          cache-to: type=gha,mode=max,scope=${{ env.PLATFORM_PAIR }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true

      - name: Export digest
        run: |
          mkdir -p "${{ runner.temp }}/digests"
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  merge-image:
    needs: build-image
    runs-on: ubuntu-latest
    permissions: write-all
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=build-${{ github.run_number }}

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.run_number }}

      - run: echo '### Output image' >> $GITHUB_STEP_SUMMARY
      - run: echo '```\n${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.run_number }}\n```\n' >> $GITHUB_STEP_SUMMARY

      - uses: actions/github-script@v7
        if: github.event_name == 'pull_request'
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '### Docker image\n\n```\n${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.run_number }}\n```\n'
            })