devcontainer-image.yml

name: devcontainer image

on:
  push:
    branches: [main]
    paths:
      - .devcontainer/**
      - .github/workflows/devcontainer-image.yml
      - .github/workflows/devcontainer-image-pr.yml
      - playground/**
      - polyglot/qualified-artifact-tuple.json
      - app/Console/Commands/Init.php
      - composer.json
      - composer.lock
      - docker/**
      - microservice/composer.json
      - microservice/composer.lock
      - package.json
      - package-lock.json
      - scripts/ci/qualify-devcontainer-image.sh
      - scripts/playground
      - scripts/resolve-current-artifacts.sh
  schedule:
    - cron: '17 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: devcontainer-image-main
  cancel-in-progress: true

env:
  GHCR_IMAGE: ghcr.io/durable-workflow/sample-app-devcontainer
  DOCKERHUB_IMAGE: durableworkflow/sample-app-devcontainer

jobs:
  build:
    name: Build ${{ matrix.platform }}
    if: github.ref == 'refs/heads/main'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: ${{ matrix.timeout_minutes }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
            suffix: amd64
            timeout_minutes: 20
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            suffix: arm64
            timeout_minutes: 30
    env:
      REVISION_TAG: sha-${{ github.sha }}-run-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Sign in to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Sign in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: durableworkflow
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build and publish immutable architecture image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          file: .devcontainer/docker/Dockerfile
          platforms: ${{ matrix.platform }}
          no-cache: true
          pull: true
          push: true
          provenance: mode=max
          sbom: true
          tags: |
            ${{ env.GHCR_IMAGE }}:${{ env.REVISION_TAG }}-${{ matrix.suffix }}
            ${{ env.DOCKERHUB_IMAGE }}:${{ env.REVISION_TAG }}-${{ matrix.suffix }}
          build-args: VCS_REF=${{ github.sha }}

  assemble:
    name: Assemble multi-platform image
    if: github.ref == 'refs/heads/main'
    needs: [build]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      packages: write
    outputs:
      revision_tag: ${{ steps.identity.outputs.revision_tag }}
    steps:
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Sign in to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Sign in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: durableworkflow
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set immutable tag
        id: identity
        run: echo "revision_tag=sha-${GITHUB_SHA}-run-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
      - name: Assemble registry indexes
        env:
          REVISION_TAG: ${{ steps.identity.outputs.revision_tag }}
        run: |
          docker buildx imagetools create \
            -t "$GHCR_IMAGE:$REVISION_TAG" \
            "$GHCR_IMAGE:$REVISION_TAG-amd64" \
            "$GHCR_IMAGE:$REVISION_TAG-arm64"
          docker buildx imagetools create \
            -t "$DOCKERHUB_IMAGE:$REVISION_TAG" \
            "$DOCKERHUB_IMAGE:$REVISION_TAG-amd64" \
            "$DOCKERHUB_IMAGE:$REVISION_TAG-arm64"

  qualify:
    name: Qualify ${{ matrix.platform }}
    if: github.ref == 'refs/heads/main'
    needs: [assemble]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Use a credential-free Docker configuration
        run: |
          mkdir -p /tmp/docker-anonymous
          printf '%s\n' '{"auths":{}}' > /tmp/docker-anonymous/config.json
          echo 'DOCKER_CONFIG=/tmp/docker-anonymous' >> "$GITHUB_ENV"
      - name: Qualify the published image
        env:
          DEVCONTAINER_EXPECTED_REVISION: ${{ github.sha }}
          DEVCONTAINER_REQUIRE_ANONYMOUS_PULL: '1'
          DEVCONTAINER_REQUIRE_PUBLISHED_ATTESTATIONS: '1'
        run: >-
          scripts/ci/qualify-devcontainer-image.sh
          "$GHCR_IMAGE:${{ needs.assemble.outputs.revision_tag }}"
          "${{ matrix.platform }}"

  promote:
    name: Publish main channel
    if: github.ref == 'refs/heads/main'
    needs: [assemble, qualify]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      packages: write
    steps:
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Sign in to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Sign in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: durableworkflow
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Promote the qualified image
        env:
          REVISION_TAG: ${{ needs.assemble.outputs.revision_tag }}
        run: |
          docker buildx imagetools create -t "$GHCR_IMAGE:main" "$GHCR_IMAGE:$REVISION_TAG"
          docker buildx imagetools create -t "$DOCKERHUB_IMAGE:main" "$DOCKERHUB_IMAGE:$REVISION_TAG"
      - name: Verify both public indexes
        run: |
          for image in "$GHCR_IMAGE:main" "$DOCKERHUB_IMAGE:main"; do
            raw="$(mktemp)"
            docker buildx imagetools inspect "$image" --raw > "$raw"
            python3 - "$raw" <<'PY'
          import json
          import sys

          manifest = json.load(open(sys.argv[1], encoding='utf-8'))
          platforms = {
              (item.get('platform') or {}).get('architecture')
              for item in manifest.get('manifests', [])
              if (item.get('platform') or {}).get('os') == 'linux'
          }
          if not {'amd64', 'arm64'} <= platforms:
              raise SystemExit(f'missing image platforms: {platforms}')
          PY
            rm -f "$raw"
          done