docker.yml

name: Docker image

on:
  release:
    types: [published]

# Serialize each release so duplicate publication events cannot race image updates.
concurrency:
  group: docker-release-${{ github.event.release.tag_name }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  # Build records are useful for short-term diagnosis but otherwise duplicate logs.
  DOCKER_BUILD_RECORD_RETENTION_DAYS: 7

jobs:
  # Validate both release images on amd64 before publishing either platform.
  build-and-test:
    name: Build & smoke test
    runs-on: ubuntu-latest
    env:
      COMPOSE_PROJECT_NAME: signalhaven-ci
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Validate release version
        env:
          IS_PRERELEASE: ${{ github.event.release.prerelease }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          # Fail before the expensive build if the GitHub release cannot map to SemVer tags.
          if [[ ! "$RELEASE_TAG" =~ ^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must be semantic, for example v1.2.3 or v1.2.3-beta.1: $RELEASE_TAG" >&2
            exit 1
          fi
          # Keep GitHub's release channel consistent with the container channel.
          version_without_build="${RELEASE_TAG%%+*}"
          if [[ "$version_without_build" == *-* && "$IS_PRERELEASE" != "true" ]]; then
            echo "A prerelease version must be published as a GitHub prerelease: $RELEASE_TAG" >&2
            exit 1
          fi
          if [[ "$version_without_build" != *-* && "$IS_PRERELEASE" == "true" ]]; then
            echo "A GitHub prerelease must use a semantic prerelease version: $RELEASE_TAG" >&2
            exit 1
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build image (load into local docker)
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          platforms: linux/amd64
          tags: signalhaven:ci
          build-args: |
            SIGNALHAVEN_VERSION=${{ github.event.release.tag_name }}
            SIGNALHAVEN_GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=signalhaven-linux-amd64
          # A stable per-platform scope lets every release advance the same cache.
          cache-to: type=gha,scope=signalhaven-linux-amd64,mode=max

      - name: Build Bonjour image (load into local docker)
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.bonjour
          load: true
          platforms: linux/amd64
          tags: signalhaven-bonjour:ci
          build-args: |
            SIGNALHAVEN_VERSION=${{ github.event.release.tag_name }}
            SIGNALHAVEN_GIT_SHA=${{ github.sha }}
          cache-from: type=gha,scope=signalhaven-bonjour-linux-amd64
          # Keep the small sidecar cache independent of the media-heavy image.
          cache-to: type=gha,scope=signalhaven-bonjour-linux-amd64,mode=max

      - name: Verify bundled media tools are present in the image
        run: |
          docker run --rm signalhaven:ci ffmpeg -version
          # Debian's Comskip reports successful help output with status 2.
          docker run --rm signalhaven:ci comskip --help >/dev/null 2>&1 || [ "$?" -eq 2 ]

      - name: Prepare HTTPS smoke-test endpoint
        run: |
          # Build a one-run trust chain so Bonjour exercises canonical HTTPS
          # without depending on external DNS, certificates, or services.
          tls_directory="$RUNNER_TEMP/signalhaven-bonjour-tls"
          mkdir -p "$tls_directory"
          openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 1 \
            -subj "/CN=SignalHaven CI Root CA" \
            -addext "basicConstraints=critical,CA:TRUE" \
            -addext "keyUsage=critical,keyCertSign,cRLSign" \
            -keyout "$tls_directory/ca.key" \
            -out "$tls_directory/ca.crt"
          openssl req -newkey rsa:2048 -sha256 -nodes \
            -subj "/CN=127.0.0.1" \
            -keyout "$tls_directory/server.key" \
            -out "$tls_directory/server.csr"
          openssl x509 -req -sha256 -days 1 \
            -in "$tls_directory/server.csr" \
            -CA "$tls_directory/ca.crt" \
            -CAkey "$tls_directory/ca.key" \
            -CAcreateserial \
            -extfile <(printf '%s\n' \
              "subjectAltName=IP:127.0.0.1" \
              "basicConstraints=critical,CA:FALSE" \
              "keyUsage=critical,digitalSignature,keyEncipherment" \
              "extendedKeyUsage=serverAuth") \
            -out "$tls_directory/server.crt"
          # The proxy drops DAC override, so its root user needs ordinary read
          # permission on this ephemeral key after the Linux bind mount.
          chmod 0444 "$tls_directory/server.key"

          # Reuse the image under test as a minimal Node.js TLS proxy. Host
          # networking makes its loopback listener reachable by the sidecar.
          docker run --detach \
            --name signalhaven-ci-tls-proxy \
            --user 0:0 \
            --network host \
            --read-only \
            --cap-drop ALL \
            --cap-add NET_BIND_SERVICE \
            --security-opt no-new-privileges:true \
            --mount "type=bind,src=$tls_directory,dst=/etc/signalhaven-ci,readonly" \
            --mount "type=bind,src=$GITHUB_WORKSPACE/.github/scripts/bonjour-smoke-proxy.mjs,dst=/signalhaven-ci/bonjour-smoke-proxy.mjs,readonly" \
            --entrypoint node \
            signalhaven-bonjour:ci \
            /signalhaven-ci/bonjour-smoke-proxy.mjs

          # Verify the restricted proxy can read its mounted key and bind HTTPS
          # before Compose runs.
          proxy_ready=false
          for i in $(seq 1 10); do
            if docker logs signalhaven-ci-tls-proxy 2>&1 | grep -q '^proxy-ready '; then
              proxy_ready=true
              break
            fi
            if [ "$(docker inspect --format '{{.State.Running}}' signalhaven-ci-tls-proxy)" != "true" ]; then
              break
            fi
            sleep 1
          done
          if [ "$proxy_ready" != "true" ]; then
            echo "HTTPS smoke-test proxy did not become ready"
            docker logs signalhaven-ci-tls-proxy
            exit 1
          fi

          # Prove a second host-networked container can reach the proxy and
          # validate its certificate with the same CA used by the sidecar.
          docker run --rm \
            --network host \
            --read-only \
            --cap-drop ALL \
            --security-opt no-new-privileges:true \
            --mount "type=bind,src=$tls_directory/ca.crt,dst=/etc/signalhaven-ci/ca.crt,readonly" \
            --env NODE_EXTRA_CA_CERTS=/etc/signalhaven-ci/ca.crt \
            --entrypoint node \
            signalhaven-bonjour:ci \
            -e 'fetch("https://127.0.0.1/api/v1/health").then((response) => { if (response.status !== 502) throw new Error("Expected pre-Compose 502, received " + response.status); }).catch((error) => { console.error(error); process.exit(1); })'

      - name: Compose smoke test
        run: |
          cp .env.example .env
          # Point compose at the locally-built image so we don't pull from
          # the registry during CI.
          export SIGNALHAVEN_IMAGE=signalhaven:ci
          export SIGNALHAVEN_BONJOUR_IMAGE=signalhaven-bonjour:ci
          export PUBLIC_URL=https://127.0.0.1
          # Exercise the runner's routable interface without probing Docker's
          # unrelated bridge devices, which cannot represent LAN discovery.
          SIGNALHAVEN_BONJOUR_INTERFACES=$(ip -4 route show default | awk '{ print $5; exit }')
          if [ -z "$SIGNALHAVEN_BONJOUR_INTERFACES" ]; then
            echo "Could not identify the runner's default IPv4 interface"
            exit 1
          fi
          export SIGNALHAVEN_BONJOUR_INTERFACES
          export SIGNALHAVEN_BONJOUR_DISABLE_IPV6=true
          compose=(docker compose --file docker-compose.yml --file .github/compose.bonjour-smoke.yml)
          # Pre-seed a root-owned volume so Docker does not copy image ownership.
          recordings_volume="${COMPOSE_PROJECT_NAME}_signalhaven-recordings"
          docker volume create "$recordings_volume"
          docker run --rm --user 0 --entrypoint sh \
            -v "$recordings_volume:/recordings" signalhaven:ci \
            -c 'mkdir -p /recordings/.signalhaven-ci-volume-seed; chown root:root /recordings; chmod 0755 /recordings'
          # Initialize sidecar state explicitly instead of relying on Docker's
          # volume copy-up behavior to preserve the image directory owner.
          bonjour_volume="${COMPOSE_PROJECT_NAME}_signalhaven-bonjour"
          docker volume create "$bonjour_volume"
          docker run --rm --user 0 --entrypoint sh \
            -v "$bonjour_volume:/state" signalhaven-bonjour:ci \
            -c 'chown 10001:10001 /state; chmod 0700 /state'
          docker run --rm --user 10001:10001 --entrypoint sh \
            -v "$bonjour_volume:/state" signalhaven-bonjour:ci \
            -c 'probe=/state/.signalhaven-ci-write-probe; : > "$probe"; rm -f "$probe"'
          "${compose[@]}" --profile bonjour up -d
          # Wait up to ~60s for SignalHaven to become healthy.
          for i in $(seq 1 30); do
            status=$(curl -s -o /tmp/health.json -w '%{http_code}' http://127.0.0.1:3000/api/v1/health || true)
            if [ "$status" = "200" ]; then
              echo "SignalHaven is healthy:"
              cat /tmp/health.json
              if ! grep -q '"db":{"ok":true}' /tmp/health.json; then
                echo "Health payload did not report db: ok"
                exit 1
              fi
              # Verify the application UID can create DVR output on the mount.
              "${compose[@]}" exec -T --user 10001:10001 signalhaven \
                sh -c 'probe=/var/lib/signalhaven/recordings/.signalhaven-ci-write-probe; : > "$probe"; rm -f "$probe"'
              break
            fi
            echo "Waiting for SignalHaven health ($i)..."
            sleep 2
          done
          if [ "$status" != "200" ]; then
            echo "SignalHaven did not become healthy in time"
            "${compose[@]}" logs
            exit 1
          fi

          # The host-networked sidecar should bind multicast and publish only
          # after the same host endpoint becomes healthy.
          advertised=false
          for i in $(seq 1 30); do
            bonjour_logs=$("${compose[@]}" --profile bonjour logs --no-color signalhaven-bonjour)
            if [[ "$bonjour_logs" == *'"event":"advertised"'* ]]; then
              advertised=true
              break
            fi
            if [[ "$bonjour_logs" == *'"event":"fatal"'* ]]; then
              echo "Bonjour sidecar exited with a fatal error"
              echo "$bonjour_logs"
              exit 1
            fi
            echo "Waiting for Bonjour advertisement ($i)..."
            sleep 2
          done
          if [ "$advertised" = "true" ]; then
            echo "Bonjour sidecar advertised SignalHaven"
            exit 0
          fi
          echo "Bonjour sidecar did not advertise in time"
          "${compose[@]}" --profile bonjour logs signalhaven-bonjour
          docker logs signalhaven-ci-tls-proxy
          exit 1

      - name: Tear down compose stack
        if: always()
        run: |
          # Remove both the application stack and the host-networked TLS proxy.
          docker compose --file docker-compose.yml --file .github/compose.bonjour-smoke.yml --profile bonjour down -v || true
          docker rm --force signalhaven-ci-tls-proxy || true

  # Build each architecture on matching hardware after the amd64 smoke test.
  publish_platform:
    name: Build & push ${{ matrix.component }} ${{ matrix.platform }}
    needs: build-and-test
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - component: signalhaven
            dockerfile: Dockerfile
            image_suffix: ""
            platform: linux/amd64
            runner: ubuntu-24.04
            artifact: signalhaven-amd64
            cache_scope: signalhaven-linux-amd64
          - component: signalhaven
            dockerfile: Dockerfile
            image_suffix: ""
            platform: linux/arm64
            runner: ubuntu-24.04-arm
            artifact: signalhaven-arm64
            cache_scope: signalhaven-linux-arm64
          - component: bonjour
            dockerfile: Dockerfile.bonjour
            image_suffix: -bonjour
            platform: linux/amd64
            runner: ubuntu-24.04
            artifact: bonjour-amd64
            cache_scope: signalhaven-bonjour-linux-amd64
          - component: bonjour
            dockerfile: Dockerfile.bonjour
            image_suffix: -bonjour
            platform: linux/arm64
            runner: ubuntu-24.04-arm
            artifact: bonjour-arm64
            cache_scope: signalhaven-bonjour-linux-arm64

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Normalize image name
        id: image
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ matrix.image_suffix }}
        run: |
          # OCI repository names are lowercase even when the GitHub repo is not.
          echo "name=${IMAGE,,}" >> "$GITHUB_OUTPUT"

      - name: Derive image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.image.outputs.name }}
          # Define moving channels explicitly so alpha/beta never advance latest.
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}},value=${{ github.event.release.tag_name }}
            type=semver,pattern={{major}}.{{minor}},value=${{ github.event.release.tag_name }}
            type=semver,pattern={{major}},value=${{ github.event.release.tag_name }}
            type=match,pattern=^v?\d+\.\d+\.\d+-(alpha|beta)(?:\.|$),group=1,value=${{ github.event.release.tag_name }}
            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
            type=sha

      - name: Build and push platform image by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: ${{ matrix.platform }}
          tags: ${{ steps.image.outputs.name }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            SIGNALHAVEN_VERSION=${{ github.event.release.tag_name }}
            SIGNALHAVEN_GIT_SHA=${{ github.sha }}
          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=${{ matrix.cache_scope }}
          # Version build args are consumed only in the final runtime layer.
          cache-to: type=gha,scope=${{ matrix.cache_scope }},mode=max

      - name: Record platform digest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          # Reject malformed action output before using it as an artifact path.
          if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "Unexpected image digest: $DIGEST" >&2
            exit 1
          fi
          mkdir -p "$RUNNER_TEMP/digests"
          touch "$RUNNER_TEMP/digests/${DIGEST#sha256:}"

      - name: Upload platform digest
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.artifact }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  # Assemble each native-platform image after every digest push succeeds.
  publish_manifest:
    name: Publish ${{ matrix.component }} multi-arch manifest
    needs: publish_platform
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - component: signalhaven
            image_suffix: ""
            artifact_pattern: signalhaven
          - component: bonjour
            image_suffix: -bonjour
            artifact_pattern: bonjour

    steps:
      - name: Download platform digests
        uses: actions/download-artifact@v4
        with:
          pattern: digest-${{ matrix.artifact_pattern }}-*
          path: ${{ runner.temp }}/digests
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Normalize image name
        id: image
        env:
          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ matrix.image_suffix }}
        run: |
          # Match the normalized name used by each platform build.
          echo "name=${IMAGE,,}" >> "$GITHUB_OUTPUT"

      - name: Derive manifest metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.image.outputs.name }}
          # Match the platform metadata exactly when assigning manifest tags.
          flavor: |
            latest=false
          tags: |
            type=semver,pattern={{version}},value=${{ github.event.release.tag_name }}
            type=semver,pattern={{major}}.{{minor}},value=${{ github.event.release.tag_name }}
            type=semver,pattern={{major}},value=${{ github.event.release.tag_name }}
            type=match,pattern=^v?\d+\.\d+\.\d+-(alpha|beta)(?:\.|$),group=1,value=${{ github.event.release.tag_name }}
            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
            type=sha

      - name: Create and verify multi-arch manifest
        env:
          DIGEST_DIRECTORY: ${{ runner.temp }}/digests
          IMAGE: ${{ steps.image.outputs.name }}
          METADATA_JSON: ${{ steps.meta.outputs.json }}
        run: |
          # Arrays preserve each generated tag as one argument without eval.
          mapfile -t tags < <(jq -r '.tags[]' <<< "$METADATA_JSON")
          mapfile -t digest_files < <(find "$DIGEST_DIRECTORY" -maxdepth 1 -type f -print | sort)

          if [[ "${#tags[@]}" -eq 0 ]]; then
            echo "No image tags were generated" >&2
            exit 1
          fi
          if [[ "${#digest_files[@]}" -ne 2 ]]; then
            echo "Expected two platform digests, found ${#digest_files[@]}" >&2
            exit 1
          fi

          tag_arguments=()
          for tag in "${tags[@]}"; do
            tag_arguments+=(--tag "$tag")
          done

          sources=()
          for digest_file in "${digest_files[@]}"; do
            digest="$(basename "$digest_file")"
            if [[ ! "$digest" =~ ^[0-9a-f]{64}$ ]]; then
              echo "Unexpected digest artifact: $digest" >&2
              exit 1
            fi
            sources+=("$IMAGE@sha256:$digest")
          done

          docker buildx imagetools create "${tag_arguments[@]}" "${sources[@]}"
          docker buildx imagetools inspect "${tags[0]}"