docker-build-release.yml

name: Build and Release Docker Container

# Only one can run at a time
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

on:
  push:
    tags:
      - 'v*'
    branches:
      - main
  workflow_dispatch:
    inputs:
      tag:
        description: 'Docker image tag (e.g., v0.1.0)'
        required: true
        type: string
  workflow_call:
    inputs:
      tag:
        description: 'Docker image tag (e.g., v0.1.0)'
        required: true
        type: string
    secrets:
      INFRA_GH_TOKEN:
        required: true

permissions:
  contents: write
  packages: write
  id-token: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
            registry: ghcr.io
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for middleware
        id: meta_middleware
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/chainsafe/canton-middleware
          tags: |
            type=ref,event=tag
            type=sha,prefix=main-,enable={{is_default_branch}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}

      - name: Extract metadata for ERC20 API
        id: meta_api
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/chainsafe/canton-erc20-api
          tags: |
            type=ref,event=tag
            type=sha,prefix=main-,enable={{is_default_branch}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}

      - name: Extract metadata for indexer
        id: meta_indexer
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/chainsafe/canton-indexer
          tags: |
            type=ref,event=tag
            type=sha,prefix=main-,enable={{is_default_branch}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}

      - name: Build and push Middlewware Docker Image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./cmd/relayer/Dockerfile
          push: true
          tags: ${{ steps.meta_middleware.outputs.tags }}
          labels: ${{ steps.meta_middleware.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

      - name: Build and push ERC20 API Server Docker Image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./cmd/api-server/Dockerfile
          push: true
          tags: ${{ steps.meta_api.outputs.tags }}
          labels: ${{ steps.meta_api.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

      - name: Build and push Indexer Docker Image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./cmd/indexer/Dockerfile
          push: true
          tags: ${{ steps.meta_indexer.outputs.tags }}
          labels: ${{ steps.meta_indexer.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

  open-devnet-pr:
    name: Open devnet deploy PR
    needs: build-and-push
    runs-on: ubuntu-latest
    # Devnet continuously tracks main: deploy the main-<sha> image on every
    # direct push to main. Release builds (workflow_call with a version tag)
    # and manual dispatches build images only — mainnet promotion is manual.
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && inputs.tag == ''
    steps:
      - name: Compute image tag
        id: version
        run: |
          # Must match the main-<sha> tag produced by docker/metadata-action above
          VERSION="main-${GITHUB_SHA::7}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Checkout infra-kubernetes
        uses: actions/checkout@v4
        with:
          repository: ChainSafe/infra-kubernetes
          token: ${{ secrets.INFRA_GH_TOKEN }}
          ref: main

      # Each service maps to a Helm values file in infra-kubernetes whose
      # top-level key matches the Helm release name. Add a service here to
      # have it bumped and deployed to devnet automatically on every main push.
      - name: Update image tags for all services
        env:
          VERSION: ${{ steps.version.outputs.version }}
          DIR: definitions/canton/validator-dev1
        run: |
          while IFS='|' read -r key file; do
            [ -z "$key" ] && continue
            echo "Bumping ${key} -> ${VERSION} in ${file}"
            yq e ".[\"${key}\"].image.tag = env(VERSION)" -i "${DIR}/${file}"
          done <<'EOF'
          canton-middleware-api|canton-middleware-api-values.yml
          canton-indexer|canton-indexer-values.yml
          canton-middleware|canton-middleware-values.yml
          EOF

      - name: Create signed commit and open PR
        env:
          VERSION: ${{ steps.version.outputs.version }}
          GH_TOKEN: ${{ secrets.INFRA_GH_TOKEN }}
          DIR: definitions/canton/validator-dev1
          REPO: ChainSafe/infra-kubernetes
          SOURCE_REPO: ${{ github.repository }}
          SOURCE_SHA: ${{ github.sha }}
        run: |
          FILES=(
            canton-middleware-api-values.yml
            canton-indexer-values.yml
            canton-middleware-values.yml
          )
          BRANCH="cd/devnet-canton-services-${VERSION}"
          COMMIT_MSG="chore(devnet): deploy canton services ${VERSION}"

          # Get current HEAD SHA of main
          HEAD_SHA=$(gh api repos/${REPO}/git/ref/heads/main --jq '.object.sha')

          # Create branch pointing at main HEAD (no-op if already exists)
          gh api repos/${REPO}/git/refs \
            --method POST \
            --field ref="refs/heads/${BRANCH}" \
            --field sha="${HEAD_SHA}" > /dev/null 2>&1 || true

          # Get current branch HEAD SHA
          BRANCH_SHA=$(gh api repos/${REPO}/git/ref/heads/${BRANCH} --jq '.object.sha')

          # Skip if every file on the branch already has this version (idempotent re-run)
          ALL_MATCH=true
          for f in "${FILES[@]}"; do
            KEY="${f%-values.yml}"
            BRANCH_TAG=$(gh api "repos/${REPO}/contents/${DIR}/${f}?ref=${BRANCH}" \
              -H "Accept: application/vnd.github.raw" 2>/dev/null \
              | yq e ".[\"${KEY}\"].image.tag" - 2>/dev/null || echo "")
            [ "$BRANCH_TAG" = "$VERSION" ] || ALL_MATCH=false
          done
          if [ "$ALL_MATCH" = "true" ]; then
            echo "Branch already at tag ${VERSION} for all services, ensuring auto-merge"
            gh pr merge --auto --squash --repo "${REPO}" "${BRANCH}" 2>/dev/null || true
            exit 0
          fi

          # Build the GraphQL additions array: one entry per file, base64-encoded
          # (no line wrapping, Linux base64). Commits via createCommitOnBranch are
          # automatically signed by GitHub (Verified).
          ADDITIONS="[]"
          for f in "${FILES[@]}"; do
            CONTENTS=$(base64 -w0 "${DIR}/${f}")
            ADDITIONS=$(jq -nc --argjson acc "$ADDITIONS" \
              --arg path "${DIR}/${f}" --arg contents "$CONTENTS" \
              '$acc + [{path: $path, contents: $contents}]')
          done

          jq -nc \
            --arg repo "$REPO" --arg branch "$BRANCH" --arg oid "$BRANCH_SHA" \
            --arg msg "$COMMIT_MSG" --argjson additions "$ADDITIONS" \
            '{
              query: "mutation($repo: String!, $branch: String!, $oid: GitObjectID!, $msg: String!, $additions: [FileAddition!]!) { createCommitOnBranch(input: { branch: { repositoryNameWithOwner: $repo, branchName: $branch }, message: { headline: $msg }, fileChanges: { additions: $additions }, expectedHeadOid: $oid }) { commit { url } } }",
              variables: { repo: $repo, branch: $branch, oid: $oid, msg: $msg, additions: $additions }
            }' | gh api graphql --input -

          # Open PR and enable auto-merge
          PR_BODY=$(cat <<EOF
          Automated continuous deployment to \`validator-dev1\`.

          Bumps \`canton-middleware-api\`, \`canton-indexer\` and \`canton-middleware\` image tags to \`${VERSION}\`.

          Source: [${SOURCE_REPO}@${SOURCE_SHA:0:7}](https://github.com/${SOURCE_REPO}/commit/${SOURCE_SHA})
          EOF
          )
          gh pr create \
            --repo "${REPO}" \
            --title "${COMMIT_MSG}" \
            --body "${PR_BODY}" \
            --base main \
            --head "${BRANCH}" \
          || { echo "PR already exists for this branch, skipping"; exit 0; }
          gh pr merge --auto --squash --repo "${REPO}" "${BRANCH}"