container.yml

name: Container

on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - 'v*'
  workflow_dispatch:

concurrency:
  group: container-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref_type != 'tag' }}

permissions:
  contents: read

env:
  REGISTRY: ghcr.io

jobs:
  quality:
    name: Quality gate
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve recommended Node.js version
        id: runtime
        shell: bash
        run: echo "version=$(jq -r '.recommendedNodeVersion' release.config.json)" >> "$GITHUB_OUTPUT"

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ steps.runtime.outputs.version }}
          cache: npm

      - name: Install locked dependencies
        run: npm ci --ignore-scripts --no-audit

      - name: Audit registry vulnerabilities and signatures
        run: npm run audit:dependencies

      - name: Run complete project checks
        run: npm run check

      - name: Run isolated container smoke test
        run: npm run test:container

  validate:
    name: Validate multi-platform image
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Build both target platforms
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: false
          provenance: false
          sbom: false
          cache-from: type=gha,scope=container

  publish:
    name: Publish multi-platform image
    if: github.event_name != 'pull_request'
    needs:
      - quality
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Validate version tag
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          expected="v$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")"
          if [[ "$GITHUB_REF_NAME" != "$expected" ]]; then
            echo "Release tag $GITHUB_REF_NAME does not match package version $expected." >&2
            exit 1
          fi

      - name: Resolve lowercase image name
        id: image
        shell: bash
        run: echo "name=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"

      - name: Extract image metadata
        id: metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
        with:
          images: ${{ steps.image.outputs.name }}
          flavor: |
            latest=false
          tags: |
            type=raw,value=edge,enable={{is_default_branch}}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}
            type=sha,prefix=sha-
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Build and push image
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          annotations: ${{ steps.metadata.outputs.annotations }}
          provenance: mode=max
          sbom: true
          cache-from: type=gha,scope=container
          cache-to: type=gha,mode=max,scope=container

      - name: Generate GitHub artifact attestation
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign image digest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          IMAGE: ${{ steps.image.outputs.name }}
        run: cosign sign --yes "${IMAGE}@${DIGEST}"

      - name: Verify published manifest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          IMAGE: ${{ steps.image.outputs.name }}
        run: docker buildx imagetools inspect "${IMAGE}@${DIGEST}"