docker.yml

# =============================================================================
# TelemetryFlow Core - Docker Image Builder Workflow
# =============================================================================
#
# TelemetryFlow Core - Full-Stack Monorepo (Backend + Frontend)
# Copyright (c) 2024-2026 Telemetri Data Indonesia. All rights reserved.
#
# Builds two Docker images:
#   1. telemetryflow/telemetryflow-core       (backend - NestJS)
#   2. telemetryflow/telemetryflow-core-viz   (frontend - Vue 3 + Nginx)
#
# Multi-platform: linux/amd64, linux/arm64
# Semantic versioning tags, Docker Hub registry
#
# =============================================================================

name: Docker Build - TelemetryFlow Core

on:
  push:
    branches:
      - main
      - master
    tags:
      - "v*.*.*"
    paths:
      - "Dockerfile*"
      - "backend/**"
      - "frontend/**"
      - "config/nginx/**"
      - "config/docker-entrypoint-viz.sh"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
      - ".github/workflows/docker.yml"
  pull_request:
    branches:
      - main
      - master
    paths:
      - "Dockerfile*"
      - "backend/**"
      - "frontend/**"
      - "config/nginx/**"
      - "config/docker-entrypoint-viz.sh"
      - "package.json"
      - "pnpm-lock.yaml"
      - "pnpm-workspace.yaml"
      - "turbo.json"
  workflow_dispatch:
    inputs:
      version:
        description: "Version tag (e.g., 1.4.0)"
        required: false
        default: ""
      push:
        description: "Push images to registry"
        required: false
        type: boolean
        default: true
      platforms:
        description: "Target platforms"
        required: false
        default: "linux/amd64,linux/arm64"

env:
  REGISTRY_DOCKER: docker.io
  IMAGE_BACKEND: telemetryflow/telemetryflow-core
  IMAGE_FRONTEND: telemetryflow/telemetryflow-core-viz
  PRODUCT_NAME: TelemetryFlow Core

permissions:
  contents: read
  id-token: write

jobs:
  prepare:
    name: Prepare Build
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      backend_tags: ${{ steps.backend-meta.outputs.tags }}
      backend_labels: ${{ steps.backend-meta.outputs.labels }}
      frontend_tags: ${{ steps.frontend-meta.outputs.tags }}
      frontend_labels: ${{ steps.frontend-meta.outputs.labels }}
      commit: ${{ steps.info.outputs.commit }}
      branch: ${{ steps.info.outputs.branch }}
      build_time: ${{ steps.info.outputs.build_time }}
      push: ${{ steps.check.outputs.push }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Get build info
        id: info
        run: |
          echo "commit=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
          echo "branch=$(git rev-parse --abbrev-ref HEAD)" >> $GITHUB_OUTPUT
          echo "build_time=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT

      - name: Determine version
        id: version
        run: |
          if [ "${{ github.event.inputs.version }}" != "" ]; then
            VERSION="${{ github.event.inputs.version }}"
          elif [[ "${{ github.ref }}" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF#refs/tags/v}"
          else
            VERSION="${{ steps.info.outputs.commit }}"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Check if should push
        id: check
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "push=false" >> $GITHUB_OUTPUT
          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "push=${{ github.event.inputs.push }}" >> $GITHUB_OUTPUT
          else
            echo "push=true" >> $GITHUB_OUTPUT
          fi

      - name: Backend Docker meta
        id: backend-meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY_DOCKER }}/${{ env.IMAGE_BACKEND }}
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=${{ github.event.inputs.version }},enable=${{ github.event.inputs.version != '' }}
            type=ref,event=branch
            type=ref,event=pr
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') || github.ref == format('refs/heads/{0}', 'master') }}
            type=sha,prefix=sha-,format=short
          labels: |
            org.opencontainers.image.title=${{ env.PRODUCT_NAME }} Backend
            org.opencontainers.image.description=NestJS backend for TelemetryFlow Core
            org.opencontainers.image.vendor=TelemetryFlow
            io.telemetryflow.product=${{ env.PRODUCT_NAME }}
            io.telemetryflow.component=core-backend

      - name: Frontend Docker meta
        id: frontend-meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY_DOCKER }}/${{ env.IMAGE_FRONTEND }}
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=${{ github.event.inputs.version }},enable=${{ github.event.inputs.version != '' }}
            type=ref,event=branch
            type=ref,event=pr
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') || github.ref == format('refs/heads/{0}', 'master') }}
            type=sha,prefix=sha-,format=short
          labels: |
            org.opencontainers.image.title=${{ env.PRODUCT_NAME }} Viz
            org.opencontainers.image.description=Vue 3 frontend for TelemetryFlow Core
            org.opencontainers.image.vendor=TelemetryFlow
            io.telemetryflow.product=${{ env.PRODUCT_NAME }}
            io.telemetryflow.component=core-viz

  build-backend:
    name: Build Backend
    runs-on: ubuntu-latest
    needs: prepare
    steps:
      - name: Free up disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/local/share/boost /usr/share/swift
          sudo apt-get clean
          docker system prune -af --volumes || true

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: needs.prepare.outputs.push == 'true' && vars.DOCKERHUB_USERNAME != ''
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_DOCKER }}
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push backend
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile.backend
          platforms: ${{ github.event.inputs.platforms || 'linux/amd64,linux/arm64' }}
          push: ${{ needs.prepare.outputs.push == 'true' }}
          tags: ${{ needs.prepare.outputs.backend_tags }}
          labels: ${{ needs.prepare.outputs.backend_labels }}
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
            GIT_COMMIT=${{ needs.prepare.outputs.commit }}
            GIT_BRANCH=${{ needs.prepare.outputs.branch }}
            BUILD_TIME=${{ needs.prepare.outputs.build_time }}
          cache-from: type=gha,scope=backend
          cache-to: type=gha,scope=backend,mode=max
          provenance: true
          sbom: true

  build-frontend:
    name: Build Frontend
    runs-on: ubuntu-latest
    needs: prepare
    steps:
      - name: Free up disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/local/share/boost /usr/share/swift
          sudo apt-get clean
          docker system prune -af --volumes || true

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: needs.prepare.outputs.push == 'true' && vars.DOCKERHUB_USERNAME != ''
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_DOCKER }}
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push frontend
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile.frontend
          platforms: ${{ github.event.inputs.platforms || 'linux/amd64,linux/arm64' }}
          push: ${{ needs.prepare.outputs.push == 'true' }}
          tags: ${{ needs.prepare.outputs.frontend_tags }}
          labels: ${{ needs.prepare.outputs.frontend_labels }}
          build-args: |
            VERSION=${{ needs.prepare.outputs.version }}
          cache-from: type=gha,scope=frontend
          cache-to: type=gha,scope=frontend,mode=max
          provenance: true
          sbom: true

  scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: [prepare, build-backend, build-frontend]
    if: needs.build-backend.result == 'success'
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: needs.prepare.outputs.push == 'true' && vars.DOCKERHUB_USERNAME != ''
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_DOCKER }}
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Scan backend image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY_DOCKER }}/${{ env.IMAGE_BACKEND }}:sha-${{ needs.prepare.outputs.commit }}
          format: "sarif"
          output: "trivy-backend.sarif"
          severity: "CRITICAL,HIGH"
        continue-on-error: true

      - name: Scan frontend image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY_DOCKER }}/${{ env.IMAGE_FRONTEND }}:sha-${{ needs.prepare.outputs.commit }}
          format: "sarif"
          output: "trivy-frontend.sarif"
          severity: "CRITICAL,HIGH"
        continue-on-error: true

      - name: Upload scan results
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: trivy-scan-results-${{ needs.prepare.outputs.commit }}
          path: trivy-*.sarif
          retention-days: 30

  summary:
    name: Build Summary
    runs-on: ubuntu-latest
    needs: [prepare, build-backend, build-frontend]
    if: always()
    steps:
      - name: Summary
        run: |
          echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Item | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| **Version** | ${{ needs.prepare.outputs.version }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Commit** | ${{ needs.prepare.outputs.commit }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Push** | ${{ needs.prepare.outputs.push }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Backend** | ${{ needs.build-backend.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Frontend** | ${{ needs.build-frontend.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Images" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "docker pull ${{ env.IMAGE_BACKEND }}:${{ needs.prepare.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "docker pull ${{ env.IMAGE_FRONTEND }}:${{ needs.prepare.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY