publish-image.yml

name: Build and publish image

on:
  schedule:
    - cron: '22 0 * * *'
      timezone: America/Detroit
  push:
    branches: [main]
  pull_request_target:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ghcr-main
  cancel-in-progress: false

env:
  DOCKER_BUILD_RECORD_UPLOAD: "false"
jobs:
  verify:
    name: Verify and scan image (pull request)
    if: >-
      github.event_name == 'pull_request_target' &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      (github.actor == 'javaDevJT' ||
      (github.actor == 'quarterback-ci[bot]' &&
      github.event.pull_request.user.id == 341165314) ||
      (github.actor == 'dependabot[bot]' &&
      github.event.pull_request.user.login == 'dependabot[bot]' &&
      github.event.pull_request.user.id == 49699333))
    runs-on: truenas-routelisttotesla-storage-40g
    timeout-minutes: 90
    permissions:
      contents: read
    steps:
      - name: Start BuildKit storage collection
        run: ci-storage-efficiency start
      - name: Check out pull request source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
      - name: Log in to Docker Hub
        if: github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]'
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set up private BuildKit
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          cache-binary: false
          driver: remote
          endpoint: tcp://buildkit:1234
          driver-opts: |
            cacert=/run/buildkit/tls/ca.pem
            cert=/run/buildkit/tls/client.pem
            key=/run/buildkit/tls/client.key
      - name: Prepare disk build cache
        id: ci_disk_cache_1
        run: ci-cache "routelisttotesla-linux-amd64"
      - name: Prepare immutable scan artifact
        id: container_security_1
        shell: bash
        env:
          SECURITY_PUBLISH: "false"
          SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1
        run: bash .github/actions/container-security/container-security.sh prepare
      - name: Build and test pull request image
        id: container_build_1
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        env:
          DOCKER_BUILD_RECORD_RETENTION_DAYS: "1"
        with:
          outputs: ${{ steps.container_security_1.outputs.exporter }}
          cache-from: type=local,src=${{ steps.ci_disk_cache_1.outputs.from }}
          cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }}
          context: .
          platforms: linux/amd64
          no-cache-filters: runtime-base,ocr-build,runtime
          push: false
          build-args: |
            VCS_REF=${{ github.event.pull_request.head.sha }}
            QB_SOURCE_COMMIT=${{ github.event.pull_request.head.sha }}
          tags: ${{ steps.container_security_1.outputs.repository }}
      - name: Generate SBOM and enforce High/Critical vulnerability gate
        id: container_scan_1
        uses: ./.github/actions/container-security
        with:
          image: oci-archive:${{ steps.container_security_1.outputs.archive }}
          platforms: linux/amd64
          report-directory: ${{ runner.temp }}/container-security/build-1
          artifact-name: container-security-${{ github.job }}-build-1
      - name: Finish BuildKit storage collection
        if: always()
        run: ci-storage-efficiency finish

  publish:
    if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main'
    runs-on: truenas-routelisttotesla-storage-40g
    timeout-minutes: 90
    permissions:
      contents: read
      packages: write
    steps:
      - name: Start BuildKit storage collection
        run: ci-storage-efficiency start
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set up private BuildKit
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          cache-binary: false
          driver: remote
          endpoint: tcp://buildkit:1234
          driver-opts: |
            cacert=/run/buildkit/tls/ca.pem
            cert=/run/buildkit/tls/client.pem
            key=/run/buildkit/tls/client.key

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare disk build cache
        id: ci_disk_cache_1
        run: ci-cache "routelisttotesla-linux-amd64"
      - name: Prepare immutable image and release tags
        id: container_security_1
        shell: bash
        env:
          SECURITY_PUBLISH: "true"
          SECURITY_RELEASE_TAGS: |
            ghcr.io/javadevjt/routelisttotesla:latest
            ghcr.io/javadevjt/routelisttotesla:sha-${{ github.sha }}
          SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1
        run: bash .github/actions/container-security/container-security.sh prepare
      - name: Build, test, and publish
        id: container_build_1
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        env:
          DOCKER_BUILD_RECORD_RETENTION_DAYS: "1"
        with:
          outputs: ${{ steps.container_security_1.outputs.exporter }}
          cache-from: |
            type=local,src=${{ steps.ci_disk_cache_1.outputs.from }}
          cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }}
          context: .
          platforms: linux/amd64
          # Refresh the assembled runtime and its derived OCR environment together.
          no-cache-filters: runtime-base,ocr-build,runtime
          push: false # Push-by-digest is configured in the exporter; tags follow the scan.
          build-args: |
            VCS_REF=${{ github.sha }}
            QB_SOURCE_COMMIT=${{ github.sha }}
          tags: ${{ steps.container_security_1.outputs.repository }}
      - name: Generate SBOM and enforce High/Critical vulnerability gate
        uses: ./.github/actions/container-security
        with:
          image: registry:${{ steps.container_security_1.outputs.repository }}@${{ steps.container_build_1.outputs.digest }}
          platforms: "linux/amd64"
          report-directory: ${{ runner.temp }}/container-security/build-1
          artifact-name: container-security-${{ github.job }}-${{ strategy.job-index || 0 }}-build-1
      - name: Finish and enforce BuildKit storage usage
        if: always()
        run: ci-storage-efficiency finish
      - name: Format bounded plaintext storage diagnostics
        id: storage_log
        if: always()
        run: |
          python3 .github/scripts/format-storage-evidence.py \
            --output "$RUNNER_TEMP/ci-storage-evidence.log" \
            --repository "$GITHUB_REPOSITORY" --revision "$GITHUB_SHA" \
            --usage-input "$RUNNER_TEMP/ci-storage-usage-start.json" \
            --usage-input "$RUNNER_TEMP/ci-storage-usage.json"
      - name: Upload bounded storage diagnostics
        if: ${{ always() && steps.storage_log.outputs.available == 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ci-log-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ strategy.job-index || 0 }}
          path: ${{ runner.temp }}/ci-storage-evidence.log
          if-no-files-found: error
          retention-days: 1
      - name: Publish release tags only after the vulnerability gate passes
        shell: bash
        env:
          SECURITY_IMAGE: ${{ steps.container_security_1.outputs.repository }}@${{ steps.container_build_1.outputs.digest }}
          SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1
        run: bash .github/actions/container-security/container-security.sh publish
      - name: Emit portable build receipt marker
        shell: bash
        env:
          SOURCE_SHA: ${{ github.sha }}
          RUN_ID: ${{ github.run_id }}
          RUN_ATTEMPT: ${{ github.run_attempt }}
          IMAGE_DIGEST: ${{ steps.container_build_1.outputs.digest }}
        run: |
          set -euo pipefail
          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
          [[ "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
          printf 'QB_BUILD_RECEIPT_V1 source_sha=%s run_id=%s run_attempt=%s digest=%s\n' \
            "$SOURCE_SHA" "$RUN_ID" "$RUN_ATTEMPT" "$IMAGE_DIGEST"

  cleanup-artifacts:
    name: Remove transient build artifacts
    needs: ["publish"]
    if: ${{ always() && github.event_name != 'pull_request_target' }}
    runs-on: truenas-routelisttotesla-storage-8g
    timeout-minutes: 10
    permissions:
      actions: write
      contents: read
    steps:
      - name: Check out trusted default branch cleanup code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Set up Python for bounded cleanup
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.13'
      - name: Delete non-retained current-run artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 .github/scripts/cleanup-actions-artifacts.py --current