container-build.yaml

name: "Container Build"

on:
  workflow_dispatch: # needed for manually running this workflow
  schedule:
    - cron: "15 3 * * *" # sadly there is no TZ support here
  push:
    branches:
      - "main"
      - "develop"

permissions:
  contents: read
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    container:
      image: moby/buildkit:latest
      options: --privileged
    steps:
      - name: Ensure GNU tar is available
        run: |
          if command -v tar >/dev/null 2>&1; then
            if tar --version 2>/dev/null | grep -qi "gnu tar"; then
              echo "GNU tar already present"; exit 0;
            fi
          fi
          if command -v apt-get >/dev/null 2>&1; then
            apt-get update
            DEBIAN_FRONTEND=noninteractive apt-get install -y tar
          elif command -v apk >/dev/null 2>&1; then
            apk add --no-cache tar
          elif command -v yum >/dev/null 2>&1; then
            yum install -y tar
          else
            echo "Unable to install GNU tar: unsupported package manager" >&2
            exit 1
          fi
          command -v tar >/dev/null 2>&1 || { echo "tar still missing" >&2; exit 1; }
      - name: Checkout code
        uses: actions/checkout@v7
      - name: Restore repository API cache
        id: repository-api-cache-restore
        uses: actions/cache/restore@v6
        with:
          path: website/data/cache
          key: repository-api-cache-${{ github.ref_name }}-${{ github.run_id }}
          restore-keys: |
            repository-api-cache-${{ github.ref_name }}-
            repository-api-cache-
      - name: Ensure cache directory exists
        run: mkdir -p website/data/cache
      - name: Build container
        run: |
          VERSION="${GITHUB_SHA::12}"
          RUN_KIND="${{ github.event_name }}"
          case "$RUN_KIND" in
            workflow_dispatch|schedule)
              # full run (manual trigger or cron) – build and push the image with ref-specific tag
              REPO="$(echo "$GITHUB_REPOSITORY" | tr "[:upper:]" "[:lower:]")"
              PARAMS="--output type=image,\"name=ghcr.io/${REPO}:${{ github.ref_name }}\",push=true"
              ;;
            *)
              # lightweight fallback (e.g. push event) – skip image push and use reduced wiki dataset
              PARAMS="--output type=image,push=false --opt build-arg:WIKI_FILE=website/test/3rd-Party-Modules.md"
              ;;
          esac
          # registry credentials
          export DOCKER_CONFIG="$(pwd)/container"
          echo "{\"auths\":{\"ghcr.io\":{\"auth\":\"$(echo -n ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} | base64 -w 0)\"}}}" > $DOCKER_CONFIG/config.json
          echo "ASSET_VERSION=$VERSION"
          # build
          buildctl-daemonless.sh build \
            --progress plain \
            --frontend=dockerfile.v0 \
            --local context=. \
            --local dockerfile=container \
            --opt build-arg:GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} \
            --opt build-arg:ASSET_VERSION="$VERSION" \
            $PARAMS \
            --output type=local,dest=build-output
          # The local exporter writes the final image filesystem; our website
          # data lives under /usr/share/nginx/website (see container/Dockerfile).
          # The pipeline always writes both of these files, so a missing file
          # is a real error and should fail the build.
          WEBSITE_DATA="build-output/usr/share/nginx/website/data"
          rm -rf website/data/cache
          mkdir -p website/data/cache
          cp -a "$WEBSITE_DATA/cache/." website/data/cache/
          cp "$WEBSITE_DATA/skipped_modules.json" website/data/skipped_modules.json
          rm -rf build-output
      - name: Upload pipeline data for validation
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: website-data
          path: website/data/skipped_modules.json
          retention-days: 1
          if-no-files-found: warn
      - name: Save repository API cache
        if: always()
        uses: actions/cache/save@v6
        with:
          path: website/data/cache
          key: repository-api-cache-${{ github.ref_name }}-${{ github.run_id }}

  validate-skipped-modules:
    needs: build
    runs-on: ubuntu-slim
    timeout-minutes: 5
    if: always() # Run even if build fails, as long as it completed

    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: lts/*

      - name: Download pipeline data
        uses: actions/download-artifact@v8
        with:
          name: website-data
          path: website/data

      - name: Validate no modules were skipped
        run: node scripts/validate-skipped-modules.ts

      - name: Upload skipped modules report (if validation failed)
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: skipped-modules-report
          path: website/data/skipped_modules.json
          retention-days: 30