docker-publish.yml

name: Docker Publish

# Builds and pushes the official runtime image
# ghcr.io/objectstack-ai/objectstack from docker/Dockerfile.
#
# Two entry points:
#   - workflow_call: invoked by release.yml right after a successful
#     `changeset publish`, with the just-published @objectstack/cli version.
#     (A plain `on: push: tags:` trigger would never fire — the release
#     workflow pushes its tags with GITHUB_TOKEN, and GitHub suppresses
#     workflow triggers from GITHUB_TOKEN-pushed refs.)
#   - workflow_dispatch: manual backfill / rebuild of an already-published
#     version, e.g. to pick up node:22-slim base-image CVE patches between
#     framework releases.
#
# The image tag always equals the @objectstack/cli version baked inside.

on:
  workflow_call:
    inputs:
      version:
        description: 'Published @objectstack/cli version to package (e.g. 14.8.0)'
        required: true
        type: string
  workflow_dispatch:
    inputs:
      version:
        description: '@objectstack/cli version to package (e.g. 14.8.0) — must already be on npm'
        required: true
        type: string

permissions:
  contents: read

jobs:
  publish:
    name: Build & push ghcr.io/objectstack-ai/objectstack
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      IMAGE: ghcr.io/objectstack-ai/objectstack
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Validate version input
        id: version
        env:
          VERSION: ${{ inputs.version }}
        run: |
          if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$'; then
            echo "::error::'$VERSION' is not a valid semver version"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU (arm64 emulation)
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute image tags
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE }}
          # Tag = CLI version. Rolling minor/major/latest tags move with every
          # publish; prereleases (x.y.z-rc.1) get only their exact tag.
          tags: |
            type=semver,pattern={{version}},value=${{ steps.version.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.version.outputs.version }}
            type=semver,pattern={{major}},value=${{ steps.version.outputs.version }}
            type=raw,value=latest,enable=${{ !contains(steps.version.outputs.version, '-') }}

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: docker
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
            OS_CLI_VERSION=${{ steps.version.outputs.version }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Smoke-test the pushed image (amd64)
        # `os --version` proves the CLI resolved, installed, and runs on the
        # pushed image; a boot test needs an artifact + DB and belongs to the
        # examples/e2e suites, not here.
        #
        # The `require()` line proves the SQL drivers are actually IN the built
        # image. `check:docs-image-tag` cannot see that: it compares the
        # Dockerfile install line against README.md's published table, and both
        # would still agree if the drivers vanished from the image. The class
        # has already cost a boot once -- docker/Dockerfile records that a tree
        # without `pg` "died at boot on `Cannot find module 'pg'`", which is why
        # the install line exists. `require()` needs no artifact and no
        # database, so it stays on the right side of the same line drawn above.
        #
        # `-w` is load-bearing, not incidental. `npm install -g` puts the
        # drivers in /usr/local/lib/node_modules, which is NOT on `require()`'s
        # search path from this image's WORKDIR (/srv/app): node's global
        # folders are $PREFIX/lib/node, and the node:22-slim base sets no
        # NODE_PATH. Run from /srv/app the probe fails on a CORRECT image, so
        # it would be a constant red rather than a check. Resolving from inside
        # the global tree is also how the real boot path resolves them --
        # driver-sql lives there too. Do not "simplify" this to a bare
        # `docker run`; verified in both directions before it landed.
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          docker pull "$IMAGE:$VERSION"
          docker run --rm "$IMAGE:$VERSION" os --version
          docker run --rm -w /usr/local/lib/node_modules "$IMAGE:$VERSION" \
            node -e "require('pg'); require('mysql2')"