docker-build.yml

name: Build and Push Docker Image

env:
  DOCKERHUB_USER: devopsiaci
  DOCKERHUB_REPO: steampipe
  GHCR_REGISTRY: ghcr.io
  GHCR_REPO: ${{ github.repository }}

on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Lint Dockerfile
        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
        with:
          dockerfile: Dockerfile
          config: .hadolint.yaml

      - name: Unit tests
        run: |
          pip install -r tests/requirements.txt
          python3 -m pytest tests/ \
            --cov=compare_snapshots \
            --cov-report=term-missing \
            --cov-fail-under=90

      - name: Build test image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          load: true
          tags: steampipe:test

      - name: Smoke test
        run: |
          docker run --rm steampipe:test steampipe --version

      - name: Container structure tests
        run: |
          docker run --rm \
            -v "$PWD/structure-tests.yaml:/structure-tests.yaml:ro" \
            -v /var/run/docker.sock:/var/run/docker.sock \
            gcr.io/gcp-runtimes/container-structure-test:latest \
            test --image steampipe:test --config /structure-tests.yaml

      - name: Security scan (Trivy)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: steampipe:test
          format: sarif
          output: trivy-results.sarif
          exit-code: "1"
          severity: CRITICAL
          ignore-unfixed: true

      - name: Upload Trivy SARIF results
        if: always()
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: trivy-results.sarif

  behavior-check:
    name: Behavior Check
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Detect version change
        id: version
        run: |
          git fetch origin ${{ github.base_ref }} --depth=1
          OLD_VERSION=$(git show origin/${{ github.base_ref }}:Dockerfile 2>/dev/null | grep -oP 'ARG STEAMPIPE_VERSION=\K.*' || echo "")
          NEW_VERSION=$(grep -oP 'ARG STEAMPIPE_VERSION=\K.*' Dockerfile)
          echo "old=$OLD_VERSION" >> "$GITHUB_OUTPUT"
          echo "new=$NEW_VERSION" >> "$GITHUB_OUTPUT"
          if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "Version change detected: $OLD_VERSION → $NEW_VERSION"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No version change"
          fi

      - name: Build test image
        if: steps.version.outputs.changed == 'true'
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          load: true
          tags: steampipe:test

      - name: Extract CLI snapshot
        if: steps.version.outputs.changed == 'true'
        run: |
          docker run --rm --network none \
            -v "$PWD/scripts:/scripts:ro" \
            steampipe:test bash /scripts/extract-cli-snapshot.sh > /tmp/cli-snapshot-new.json

      - name: Extract env vars from upstream source
        if: steps.version.outputs.changed == 'true'
        run: |
          ENV_VARS=$(bash scripts/extract-env-vars.sh "${{ steps.version.outputs.new }}")
          jq --argjson env_vars "$ENV_VARS" '. + {env_vars: $env_vars}' /tmp/cli-snapshot-new.json > /tmp/cli-snapshot-full.json

      - name: Compare snapshots
        id: diff
        if: steps.version.outputs.changed == 'true'
        run: |
          python3 scripts/compare_snapshots.py \
            cli-snapshot.json /tmp/cli-snapshot-full.json \
            --output-md /tmp/behavior-diff.md \
            --output-json /tmp/behavior-diff.json \
            && echo "has_changes=false" >> "$GITHUB_OUTPUT" \
            || echo "has_changes=true" >> "$GITHUB_OUTPUT"

      - name: Comment on PR
        if: steps.version.outputs.changed == 'true'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const md = fs.readFileSync('/tmp/behavior-diff.md', 'utf8');
            const marker = '<!-- behavior-check -->';

            // Find and update existing comment, or create new one
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c => c.body.includes(marker));

            const body = `${marker}\n${md}`;
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

  release:
    name: Release
    needs: [test]
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      artifact-metadata: write
      contents: write
      id-token: write
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Get Steampipe version
        id: version
        run: |
          VERSION=$(grep -oP 'ARG STEAMPIPE_VERSION=\K.*' Dockerfile)
          TAG="v${VERSION}"
          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
          if git rev-parse "${TAG}" >/dev/null 2>&1; then
            echo "is_new=false" >> "${GITHUB_OUTPUT}"
            echo "Tag ${TAG} already exists — skipping release"
          else
            echo "is_new=true" >> "${GITHUB_OUTPUT}"
            echo "New version detected: ${TAG}"
          fi

      - name: Create release tag
        if: steps.version.outputs.is_new == 'true'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "${{ steps.version.outputs.tag }}" \
            -m "Release ${{ steps.version.outputs.tag }}"
          git push origin "${{ steps.version.outputs.tag }}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub Release
        if: steps.version.outputs.is_new == 'true'
        run: |
          gh release create "${{ steps.version.outputs.tag }}" \
            --title "${{ steps.version.outputs.tag }}" \
            --generate-notes \
            --latest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set Docker metadata
        id: meta
        if: steps.version.outputs.is_new == 'true'
        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
          labels: |
            org.opencontainers.image.maintainer='amartingarcia,ialejandro'
            org.opencontainers.image.title='Steampipe'
            org.opencontainers.image.description='Steampipe CLI — Use SQL to query cloud APIs'
            org.opencontainers.image.vendor='devops-ia'
          tags: |
            type=raw,value=${{ steps.version.outputs.tag }}

      - name: Set up QEMU
        if: steps.version.outputs.is_new == 'true'
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0

      - name: Set up Docker Buildx
        if: steps.version.outputs.is_new == 'true'
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Cache Docker layers
        if: steps.version.outputs.is_new == 'true'
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: "[DOCKERHUB] Log in"
        if: steps.version.outputs.is_new == 'true'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: "[GHCR] Log in"
        if: steps.version.outputs.is_new == 'true'
        continue-on-error: true
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: push
        if: steps.version.outputs.is_new == 'true'
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
          context: .
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          push: true
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}

      - name: "[DOCKERHUB] Update registry description"
        if: steps.version.outputs.is_new == 'true'
        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          repository: ${{ env.DOCKERHUB_USER }}/${{ env.DOCKERHUB_REPO }}

      - name: "[GHCR] Generate artifact attestation"
        if: steps.version.outputs.is_new == 'true'
        continue-on-error: true
        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
        with:
          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_REPO }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

      - name: Move Docker cache
        if: steps.version.outputs.is_new == 'true'
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache