ci-container.yml

name: Publish Container
on:
  push:
    branches:
      - develop
      - master
    tags:
      - 'eXist-*'
      - '!eXist-*-oidc-smoke'
  pull_request:
  schedule:
      - cron: "0 6 * * *"
  workflow_dispatch:

jobs:
  build:
    name: Test and Publish Container Images
    runs-on: ubuntu-latest
    timeout-minutes: 60
    # Publish on develop (latest) and eXist-* tags (versioned + release); test on PRs against these branches.
    if: >
      github.ref == 'refs/heads/develop' ||
      github.ref == 'refs/heads/master' ||
      startsWith(github.ref, 'refs/tags/eXist-') ||
      github.base_ref == 'develop' ||
      github.base_ref == 'master'
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4
        with:
          platforms: linux/amd64,linux/arm64
      - name: Enable containerd image store
        run: |
          echo '{ "features": { "containerd-snapshotter": true } }' | sudo tee /etc/docker/daemon.json
          sudo systemctl restart docker
      - name: Verify containerd snapshotter is active
        run: docker info -f '{{.DriverStatus}}'
      - name: Make buildkit default
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
        with:
          driver: docker
        id: buildx
      - uses: ./.github/actions/maven-cache
      - uses: ./.github/actions/maven-github-settings
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install bats
        run: sudo apt-get install bats
        # Hack around #5450
      - name: pull base image
        run: |
          docker pull --platform linux/amd64 --platform linux/arm64 gcr.io/distroless/java21-debian13:latest
      - name: Build images
        timeout-minutes: 35
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          REVISION_ARG=""
          if [[ "${{ github.ref }}" == refs/tags/eXist-* ]]; then
            VERSION="${{ github.ref_name }}"
            REVISION_ARG="-Drevision=${VERSION#eXist-}"
          fi
          mvn -V -B --no-transfer-progress \
            -Ddocker.sbom=true -Ddocker.provenance=true \
            -Pdocker,skip-build-dist-archives \
            -DskipTests -Ddependency-check.skip=true \
            $REVISION_ARG \
            clean package
      - name: Check local images
        run: docker image ls
      - name: Check license headers
        run: mvn --no-transfer-progress license:check
        working-directory: exist-docker
      - name: Start exist-ci container
        run: |
          docker run -dit -p 8080:8080 --name exist-ci --rm existdb/existdb:latest
          sleep 35s
      - name: Run tests
        run: bats --tap exist-docker/src/test/bats/*.bats

      - name: debug logs
        if: failure()
        run: docker logs exist-ci | grep 'ERROR'

      - name: Capture container logs on failure
        if: failure()
        run: |
          echo "Capturing container stdout/stderr..."
          docker logs exist-ci > exist.log 2>&1 || true

      - name: Upload logs artifact
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: exist-core-failed-log
          path: exist.log

      - name: Publish latest images
        if: github.repository == 'eXist-db/exist' && github.ref == 'refs/heads/develop'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: mvn --no-transfer-progress -q -Ddocker.tag=latest -Ddocker.username=$DOCKER_USERNAME -Ddocker.password=$DOCKER_PASSWORD docker:build docker:push
        working-directory: ./exist-docker

      - name: Publish versioned release images
        if: github.repository == 'eXist-db/exist' && startsWith(github.ref, 'refs/tags/eXist-')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#eXist-}"
          mvn --no-transfer-progress -q \
            -Drevision="$VERSION" \
            -Ddocker.tag=release \
            -Ddocker.username=$DOCKER_USERNAME \
            -Ddocker.password=$DOCKER_PASSWORD \
            docker:build docker:push
        working-directory: ./exist-docker

      # NOTE (DP): This is for debugging, publishes an experimental image from inside PRs against develop
      # - name: Publish experimental images
      #   if: github.base_ref == 'develop'
      #   env:
      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #     DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      #     DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
      #   run: mvn -q -Ddocker.tag=experimental -Ddocker.username=$DOCKER_USERNAME -Ddocker.password=$DOCKER_PASSWORD docker:build docker:push
      #   working-directory: ./exist-docker