ci.yaml

name: ci
on:
  workflow_dispatch:
  push:
    branches:
      - release

env:
  REGISTRY: ghcr.io
  ORG: ethaxon
permissions:
  contents: read
  packages: write
  actions: write

jobs:
  build-confluence-binary:
    name: Build Confluence Binary (${{ matrix.tag_suffix }})
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux/amd64
            tag_suffix: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            tag_suffix: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up mise
        uses: jdx/mise-action@v4
      - name: Install toolchain
        run: mise install
      - name: Restore Rust build cache
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: confluence-${{ matrix.tag_suffix }}
          workspaces: |
            . -> target
      - name: Build confluence binary
        run: mise exec --command "cargo build --locked --release --bin confluence_server"
      - name: Upload confluence binary
        uses: actions/upload-artifact@v7
        with:
          name: confluence-server-${{ matrix.tag_suffix }}
          path: target/release/confluence_server
          if-no-files-found: error

  package-confluence-image:
    name: Package Confluence Image (${{ matrix.tag_suffix }})
    runs-on: ${{ matrix.runner }}
    needs: build-confluence-binary
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-24.04
            platform: linux/amd64
            tag_suffix: amd64
          - runner: ubuntu-24.04-arm
            platform: linux/arm64
            tag_suffix: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Download confluence binary
        uses: actions/download-artifact@v8
        with:
          name: confluence-server-${{ matrix.tag_suffix }}
          path: dist/confluence
      - name: Ensure binary is executable
        run: chmod +x dist/confluence/confluence_server
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push architecture image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: "apps/confluence/Dockerfile.runtime"
          platforms: ${{ matrix.platform }}
          push: true
          tags: "ghcr.io/${{ env.ORG }}/confluence:sha-${{ github.sha }}-${{
            matrix.tag_suffix }}"

  publish-confluence-manifest:
    name: Publish Confluence Manifest
    runs-on: ubuntu-24.04
    needs: package-confluence-image
    permissions:
      contents: read
      packages: write
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish multi-arch manifest
        run: |
          docker buildx imagetools create \
            --tag ghcr.io/${{ env.ORG }}/confluence:latest \
            --tag ghcr.io/${{ env.ORG }}/confluence:sha-${{ github.sha }} \
            ghcr.io/${{ env.ORG }}/confluence:sha-${{ github.sha }}-amd64 \
            ghcr.io/${{ env.ORG }}/confluence:sha-${{ github.sha }}-arm64
      - name: Inspect published manifest
        run: docker buildx imagetools inspect ghcr.io/${{ env.ORG }}/confluence:sha-${{
          github.sha }}

  build-web:
    name: Build Outposts Web
    runs-on: ubuntu-latest
    environment: BUILD
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 11.0.3
      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - name: Install workspace dependencies
        run: pnpm install --frozen-lockfile
      - name: Run lint
        run: pnpm lint
      - name: Check formatting
        run: pnpm format:check
      - name: Create dotenv
        uses: iamsauravsharma/create-dotenv@v4.0.0
        env:
          AUTH_TYPE: ${{ vars.AUTH_TYPE }}
          OIDC_ISSUER: ${{ vars.OIDC_ISSUER }}
          OUTPOSTS_WEB_OIDC_CLIENT_ID: ${{ vars.OUTPOSTS_WEB_OIDC_CLIENT_ID }}
          OUTPOSTS_WEB_HOST: ${{ vars.OUTPOSTS_WEB_HOST }}
          CONFLUENCE_API_ENDPOINT: ${{ vars.CONFLUENCE_API_ENDPOINT }}
          CONFLUENCE_OIDC_SCOPES: ${{ vars.CONFLUENCE_OIDC_SCOPES }}
        with:
          input-prefix: "" # Optional (default: '')
          file-path: ".env" # Optional (default : '.env')
          output-prefix: "" # Optional (default: '')
      - name: Build outposts-web
        run: pnpm run build:outposts-web
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: "apps/outposts-web/Dockerfile.runtime"
          push: true
          tags: "ghcr.io/${{ env.ORG }}/outposts-web:latest"
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build and push web host Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: "apps/outposts-web-host/Dockerfile.runtime"
          push: true
          tags: "ghcr.io/${{ env.ORG }}/outposts-web-host:latest"
          cache-from: type=gha
          cache-to: type=gha,mode=max

  dispatch-cd:
    name: Dispatch CD Workflow
    runs-on: ubuntu-latest
    needs:
      - publish-confluence-manifest
      - build-web
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/release' }}
    permissions:
      actions: write
      contents: read
    steps:
      - name: Trigger cd workflow
        uses: actions/github-script@v8
        with:
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: context.repo.owner,
              repo: context.repo.repo,
              workflow_id: "cd.yaml",
              ref: context.ref.replace("refs/heads/", ""),
            });