IONOS(ci): rewire hidrive-next-build to consume per-app cached artifacts

printminion-co · printminion-co · commit 58f58be9abe8 · 2026-05-12T17:39:26.000+02:00
Retires the inline app-build path in hidrive-next-build: the job now
depends on prepare-matrix + build-apps and restores every app's tarball
from JFrog (using the apps_to_restore + apps_to_build outputs from
prepare-matrix) before running make -f IONOS/Makefile build_nextcloud_only.

- hidrive-next-build now needs: [prepare-matrix, build-apps]
- All seven per-app build steps (build_dep_simplesettings_app,
  build_dep_viewer_app, build_richdocuments_app, build_dep_user_oidc_app,
  build_dep_nc_ionos_processes_app, build_dep_theming_app,
  build_dep_ionos_theme) are removed — those builds run in parallel in
  build-apps instead
- A new Restore all apps from JFrog and GitHub cache step iterates the
  per-app JSON arrays, downloads each tarball from JFrog and extracts it
  in place, then validates the target path exists
- A JFrog credential availability check + assert ensures the job fails
  fast with a clear diagnostic when the JFrog secret set is incomplete
  (artifact restore has no graceful degradation path)
- Build Nextcloud switches from build_nextcloud to build_nextcloud_only —
  apps are already on disk so only the core build is needed
- Downstream upload-to-artifactory, hidirve-next-artifact-to-ghcr_io, and
  trigger-remote-dev-worflow needs:/if: are updated to include
  prepare-matrix + build-apps in their wait list

Net effect: each app builds once (in build-apps), all caches via JFrog +
GitHub Actions cache, and the final image assembly is purely composition.

Signed-off-by: Misha M.-Kupriyanov &lt;kupriyanov@strato.de&gt;
diff --git a/.github/workflows/hidrive-next-build.yml b/.github/workflows/hidrive-next-build.yml
@@ -305,6 +305,11 @@ jobs:
 
   hidrive-next-build:
     runs-on: ubuntu-latest
+    needs: [prepare-matrix, build-apps]
+    if: |
+      always() &&
+      needs.prepare-matrix.result == 'success' &&
+      (needs.build-apps.result == 'success' || needs.build-apps.result == 'skipped')
 
     permissions:
       contents: read
@@ -319,6 +324,118 @@ jobs:
         with:
           submodules: true
 
+      - name: Check JFrog credentials
+        id: jfrog-creds
+        env:
+          JF_URL: ${{ secrets.JF_ARTIFACTORY_URL }}
+          JF_USER: ${{ secrets.JF_ARTIFACTORY_USER }}
+          JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
+        run: |
+          if [ -n "$JF_URL" ] && [ -n "$JF_USER" ] && [ -n "$JF_ACCESS_TOKEN" ]; then
+            echo "available=true" >> $GITHUB_OUTPUT
+          else
+            echo "available=false" >> $GITHUB_OUTPUT
+            echo "⚠ Full JFrog credential set not available — artifact restore is not possible"
+          fi
+
+      - name: Assert JFrog credentials are available (required for artifact restore)
+        if: steps.jfrog-creds.outputs.available != 'true'
+        run: |
+          echo "❌ JFrog credentials are required for hidrive-next-build artifact restore."
+          echo "   Set JF_ARTIFACTORY_URL, JF_ARTIFACTORY_USER, and JF_ACCESS_TOKEN secrets."
+          exit 1
+
+      - name: Setup JFrog CLI
+        if: steps.jfrog-creds.outputs.available == 'true'
+        uses: jfrog/setup-jfrog-cli@7c95feb32008765e1b4e626b078dfd897c4340ad # v4.4.1
+        env:
+          JF_URL: ${{ secrets.JF_ARTIFACTORY_URL }}
+          JF_USER: ${{ secrets.JF_ARTIFACTORY_USER }}
+          JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
+
+      - name: Ping JFrog server
+        if: steps.jfrog-creds.outputs.available == 'true'
+        run: jf rt ping
+
+      - name: Restore all apps from JFrog and GitHub cache
+        if: steps.jfrog-creds.outputs.available == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          EFFECTIVE_VERSION="${{ needs.prepare-matrix.outputs.effective_cache_version }}"
+          FULL_MATRIX='${{ needs.prepare-matrix.outputs.apps_matrix }}'
+
+          # Restore cached apps (from detect-app-cache.sh output)
+          if [ "${{ needs.prepare-matrix.outputs.has_apps_to_restore }}" == "true" ]; then
+            echo "Restoring cached apps..."
+            APPS_TO_RESTORE='${{ needs.prepare-matrix.outputs.apps_to_restore }}'
+            while read -r app_json; do
+              APP_NAME=$(echo "$app_json" | jq -r '.name')
+              APP_PATH=$(echo "$app_json" | jq -r '.path')
+              SOURCE=$(echo "$app_json" | jq -r '.source')
+
+              echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+              echo "Restoring: $APP_NAME (source: $SOURCE)"
+
+              if [ "$SOURCE" == "jfrog" ]; then
+                JFROG_PATH=$(echo "$app_json" | jq -r '.jfrog_path')
+                ARCHIVE_NAME=$(echo "$app_json" | jq -r '.archive_name // empty')
+                if [ -z "$ARCHIVE_NAME" ]; then
+                  ARCHIVE_NAME="$(basename "$JFROG_PATH")"
+                fi
+                echo "Downloading from JFrog: $JFROG_PATH"
+                jf rt download "$JFROG_PATH" "$ARCHIVE_NAME" --flat=true
+                mkdir -p "$(dirname "$APP_PATH")"
+                tar -xzf "$ARCHIVE_NAME" -C "$(dirname "$APP_PATH")"
+                rm -f "$ARCHIVE_NAME"
+                if [ -d "$APP_PATH" ]; then
+                  echo "✅ Restored $APP_NAME from JFrog"
+                else
+                  echo "❌ Restore validation failed: $APP_PATH not found"
+                  exit 1
+                fi
+
+              elif [ "$SOURCE" == "github-cache" ]; then
+                CACHE_KEY=$(echo "$app_json" | jq -r '.cache_key')
+                echo "❌ Cannot restore $APP_NAME from GitHub cache within a shell step."
+                echo "   Cache key: $CACHE_KEY"
+                echo "   GitHub Actions cache requires 'actions/cache/restore@v4' as a dedicated workflow step."
+                exit 1
+              fi
+            done < <(echo "$APPS_TO_RESTORE" | jq -c '.[]')
+          fi
+
+          # Restore newly built apps from JFrog (apps_to_build)
+          if [ "${{ needs.prepare-matrix.outputs.has_apps_to_build }}" == "true" ]; then
+            echo "Restoring newly built apps from JFrog..."
+            APPS_TO_BUILD='${{ needs.prepare-matrix.outputs.apps_to_build }}'
+            while read -r app_json; do
+              APP_NAME=$(echo "$app_json" | jq -r '.name')
+              ARCHIVE_NAME=$(echo "$app_json" | jq -r '.archive_name')
+              JFROG_PATH=$(echo "$app_json" | jq -r '.jfrog_path')
+              APP_PATH=$(echo "$FULL_MATRIX" | jq -r --arg name "$APP_NAME" '.[] | select(.name == $name) | .path')
+
+              echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+              echo "Restoring newly built: $APP_NAME"
+              echo "Downloading from JFrog: $JFROG_PATH"
+
+              jf rt download "$JFROG_PATH" "$ARCHIVE_NAME" --flat=true
+              mkdir -p "$(dirname "$APP_PATH")"
+              tar -xzf "$ARCHIVE_NAME" -C "$(dirname "$APP_PATH")"
+              rm -f "$ARCHIVE_NAME"
+
+              if [ -d "$APP_PATH" ]; then
+                echo "✅ Restored $APP_NAME from JFrog"
+              else
+                echo "❌ Restore validation failed: $APP_PATH not found"
+                exit 1
+              fi
+            done < <(echo "$APPS_TO_BUILD" | jq -c '.[]')
+          fi
+
+          echo "✅ All apps restored"
+
       - name: Set up node with version from package.json's engines
         uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
@@ -341,41 +458,8 @@ jobs:
       - name: Print PHP install
         run: php -i && php -m
 
-      - name: Build Nextcloud
-        run: make -f IONOS/Makefile build_nextcloud
-
-      - name: Install dependencies & build simplesettings app
-        env:
-          CYPRESS_INSTALL_BINARY: 0
-          PUPPETEER_SKIP_DOWNLOAD: true
-        run: make -f IONOS/Makefile build_dep_simplesettings_app
-
-      - name: Install dependencies & build viewer app
-        env:
-          CYPRESS_INSTALL_BINARY: 0
-          PUPPETEER_SKIP_DOWNLOAD: true
-        run: make -f IONOS/Makefile build_dep_viewer_app
-
-      - name: Install dependencies & build richdocuments app
-        run: make -f IONOS/Makefile build_richdocuments_app
-
-      - name: Install dependencies & build user_oidc app
-        env:
-          CYPRESS_INSTALL_BINARY: 0
-          PUPPETEER_SKIP_DOWNLOAD: true
-        run: make -f IONOS/Makefile build_dep_user_oidc_app
-
-      - name: Install dependencies for external apps nc_ionos_processes
-        run: make -f IONOS/Makefile build_dep_nc_ionos_processes_app
-
-      - name: Build Custom CSS
-        run: make -f IONOS/Makefile build_dep_theming_app
-
-      - name: Install dependencies & build IONOS theme custom elements
-        env:
-          CYPRESS_INSTALL_BINARY: 0
-          PUPPETEER_SKIP_DOWNLOAD: true
-        run: make -f IONOS/Makefile build_dep_ionos_theme
+      - name: Build Nextcloud (core only — apps restored from cache)
+        run: make -f IONOS/Makefile build_nextcloud_only
 
       - name: Add config partials
         run: make -f IONOS/Makefile add_config_partials
@@ -386,7 +470,6 @@ jobs:
         run: |
           echo "${{ github.run_number }}" > .buildnumber
           echo "✅ Build number injected: ${{ github.run_number }}"
-          echo "📄 File created: .buildnumber"
           cat .buildnumber
 
       - name: Zip dependencies
@@ -422,11 +505,16 @@ jobs:
 
   upload-to-artifactory:
     runs-on: self-hosted
-    # Upload the artifact to the Artifactory repository on PR *OR* on "ionos-dev|ionos-stable" branch push defined in the on:push:branches
-    if: github.event_name == 'pull_request' || github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable'
+    # Upload the artifact to the Artifactory repository on PR *OR* on "ionos-dev|ionos-stable" branch push
+    if: |
+      always() &&
+      (github.event_name == 'pull_request' || github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable') &&
+      needs.prepare-matrix.result == 'success' &&
+      (needs.build-apps.result == 'success' || needs.build-apps.result == 'skipped') &&
+      needs.hidrive-next-build.result == 'success'
 
     name: Push to artifactory
-    needs: hidrive-next-build
+    needs: [prepare-matrix, build-apps, hidrive-next-build]
 
     outputs:
       ARTIFACTORY_LAST_BUILD_PATH: ${{ steps.artifactory_upload.outputs.ARTIFACTORY_LAST_BUILD_PATH }}
@@ -498,7 +586,7 @@ jobs:
       packages: write
 
     name: Push artifact to ghcr.io
-    needs: hidrive-next-build
+    needs: [prepare-matrix, build-apps, hidrive-next-build]
 
     steps:
       - name: Download artifact zip
