build-test-runner.yml

name: Build test runner image

on:
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 1'

# Minimum permissions. `id-token: write` is required for OIDC-backed
# signing of the build provenance attestation; `attestations: write`
# is required to upload that attestation to the GHCR package.
permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write

concurrency:
  group: build-test-runner-${{ github.ref }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}-runner

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # PHP 8.0 Chromium is pinned: Alpine 3.16 is EOL with no upstream updates.
        # PHP 8.4 Chromium floats: picks latest from Alpine on each rebuild.
        # Verify Chromium availability with:
        # `docker run --rm php:<ver>-cli-alpine sh -c 'apk update; apk policy chromium'`.
        include:
          - php_version: '8.0'
            chromium_version: '102.0.5005.182-r0'
          - php_version: '8.4'
            chromium_version: ''
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Resolve content version
        id: content_version
        run: echo "value=v$(date -u +%Y%m%dT%H%M%SZ)" >> "$GITHUB_OUTPUT"

      - name: Lowercase image name
        id: image
        run: echo "name=${IMAGE_NAME,,}" >> "$GITHUB_OUTPUT"

      - name: Select build cache backend
        id: cache
        run: |
          if [ -n "${ACT:-}" ]; then
            # act's cache server is incompatible with buildx's gha exporter
            # (nektos/act#1916), so disable the cache backend under act. Layer
            # reuse instead comes from the host docker daemon's own build cache
            # (see the act-skipped "Set up Docker Buildx" step below).
            echo "from=" >> "$GITHUB_OUTPUT"
            echo "to=" >> "$GITHUB_OUTPUT"
          else
            echo "from=type=gha,scope=test-runner-php${{ matrix.php_version }}" >> "$GITHUB_OUTPUT"
            echo "to=type=gha,mode=max,scope=test-runner-php${{ matrix.php_version }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Docker Buildx
        # Skipped under act: the container-driver builder's cache is discarded
        # on cleanup, so its layers wouldn't survive between local runs. Without
        # it, Pass 1 builds on the default docker driver and reuses the host
        # daemon's own build cache, which persists. Pass 2 (the only multi-arch
        # step) needs this builder but is already act-skipped.
        if: ${{ !env.ACT }}
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Log in to GHCR
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Pass 1: Build test image (amd64 only, load to docker daemon)'
        id: build_test
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          platforms: linux/amd64
          build-args: |
            PHP_VERSION=${{ matrix.php_version }}
            CHROMIUM_VERSION=${{ matrix.chromium_version }}
          tags: test-runner:php${{ matrix.php_version }}
          cache-from: ${{ steps.cache.outputs.from }}
          cache-to: ${{ steps.cache.outputs.to }}

      - name: Bootstrap WordPress in test image
        run: docker run --rm -v "$PWD:/var/www/html" -w /var/www/html test-runner:php${{ matrix.php_version }} bash resources/install.sh

      - name: Install PHP dependencies in test image
        # The named volume persists Composer's download cache (COMPOSER_HOME)
        # across runs, since the container itself is removed (--rm). Keyed per
        # PHP version so parallel matrix legs don't contend on one cache.
        run: docker run --rm -v "$PWD:/var/www/html" -v "aztec-wp-browser-composer-php${{ matrix.php_version }}:/tmp/composer" -w /var/www/html test-runner:php${{ matrix.php_version }} composer update

      - name: Run acceptance tests
        run: docker run --rm -v "$PWD:/var/www/html" -w /var/www/html test-runner:php${{ matrix.php_version }} codecept run acceptance

      - name: 'Pass 2: Build and push (amd64 + arm64, only if tests passed)'
        id: build
        if: ${{ !env.ACT }}
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          build-args: |
            PHP_VERSION=${{ matrix.php_version }}
            CHROMIUM_VERSION=${{ matrix.chromium_version }}
          tags: |
            ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}:php${{ matrix.php_version }}
            ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}:${{ steps.content_version.outputs.value }}-php${{ matrix.php_version }}
          cache-from: ${{ steps.cache.outputs.from }}
          cache-to: ${{ steps.cache.outputs.to }}
          provenance: mode=max
          sbom: true

      - name: Attest build provenance
        if: ${{ !env.ACT }}
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true