docker-release.yml

name: Docker Release Build

on:
  release:
    types: [published]

concurrency:
  group: docker-release-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  guard:
    runs-on: ubuntu-latest
    outputs:
      should-run: ${{ steps.check.outputs.should-run }}
    steps:
      - id: check
        run: |
          if [[ "${GITHUB_REPOSITORY}" == "eclipse-basyx/basyx-go-components" && "${GITHUB_EVENT_REPOSITORY_FORK}" != "true" ]]; then
            echo "✅ Running in upstream repository"
            echo "should-run=true" >> "$GITHUB_OUTPUT"
          else
            echo "⏭️ Skipping build — fork detected (${GITHUB_REPOSITORY})"
            echo "should-run=false" >> "$GITHUB_OUTPUT"
          fi

  build-and-push:
    needs: guard
    if: ${{ needs.guard.outputs.should-run == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      contents: read
      id-token: write
    strategy:
      max-parallel: 12
      matrix:
        service:
          - name: aasenvironmentservice
            image: eclipsebasyx/aasenvironment-go
          - name: aasregistryservice
            image: eclipsebasyx/aasregistry-go
          - name: discoveryservice
            image: eclipsebasyx/aasdiscovery-go
          - name: digitaltwinregistryservice
            image: eclipsebasyx/digitaltwinregistry-go
          - name: companylookupservice
            image: eclipsebasyx/companylookup-go
          - name: submodelrepositoryservice
            image: eclipsebasyx/submodelrepository-go
          - name: submodelregistryservice
            image: eclipsebasyx/submodelregistry-go
          - name: conceptdescriptionrepositoryservice
            image: eclipsebasyx/conceptdescriptionrepository-go
          - name: aasrepositoryservice
            image: eclipsebasyx/aasrepository-go
          - name: aasxfileserverservice
            image: eclipsebasyx/aasxfileserver-go
          - name: basyxconfigurationservice
            image: eclipsebasyx/basyxconfigurationservice-go
          - name: dppapiservice
            image: eclipsebasyx/dppapi-go

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
        with:
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["mirror.gcr.io"]

      - name: Log in to Docker Hub
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v2.4.1

      - name: Install Syft (verified)
        run: |
          set -euo pipefail
          SYFT_VERSION=1.29.1
          BASE_URL="https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}"
          ARCHIVE="syft_${SYFT_VERSION}_linux_amd64.tar.gz"
          CHECKSUMS="syft_${SYFT_VERSION}_checksums.txt"
          CERT="${CHECKSUMS}.pem"
          SIG="${CHECKSUMS}.sig"

          curl -fsSLO "${BASE_URL}/${ARCHIVE}"
          curl -fsSLO "${BASE_URL}/${CHECKSUMS}"
          curl -fsSLO "${BASE_URL}/${CERT}"
          curl -fsSLO "${BASE_URL}/${SIG}"

          cosign verify-blob "${CHECKSUMS}" \
            --certificate "${CERT}" \
            --signature "${SIG}" \
            --certificate-identity-regexp '^https://github.com/anchore/syft/\.github/workflows/.+$' \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

          grep " ${ARCHIVE}$" "${CHECKSUMS}" | sha256sum -c -
          tar -xzf "${ARCHIVE}" syft
          sudo install -m 0755 syft /usr/local/bin/syft
          syft version

      - name: Generate version tags
        id: meta
        run: |
          # Remove 'v' prefix from tag if present
          VERSION=${GITHUB_REF_NAME#v}
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

          # Parse semantic version (e.g., 1.2.3)
          if [[ $VERSION =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-.*)?$ ]]; then
            MAJOR="${BASH_REMATCH[1]}"
            MINOR="${BASH_REMATCH[2]}"
            PATCH="${BASH_REMATCH[3]}"
            PRERELEASE="${BASH_REMATCH[4]}"

            echo "major=${MAJOR}" >> $GITHUB_OUTPUT
            echo "minor=${MINOR}" >> $GITHUB_OUTPUT
            echo "patch=${PATCH}" >> $GITHUB_OUTPUT

            # Build tag list
            TAGS="${{ matrix.service.image }}:${VERSION}"

            # Only add major/minor/latest tags for non-prerelease versions
            if [ -z "$PRERELEASE" ]; then
              TAGS="${TAGS},${{ matrix.service.image }}:${MAJOR}.${MINOR}.${PATCH}"
              TAGS="${TAGS},${{ matrix.service.image }}:${MAJOR}.${MINOR}"
              TAGS="${TAGS},${{ matrix.service.image }}:${MAJOR}"
              TAGS="${TAGS},${{ matrix.service.image }}:latest"
            else
              echo "Prerelease detected: ${PRERELEASE}"
            fi

            echo "tags=${TAGS}" >> $GITHUB_OUTPUT
            echo "Building release version: ${VERSION}"
            echo "Docker tags: ${TAGS}"
          else
            echo "Error: Invalid semantic version format: ${VERSION}"
            exit 1
          fi

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: ./cmd/${{ matrix.service.name }}/Dockerfile
          pull: true
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: |
            type=gha,scope=basyx-docker-snapshot-${{ matrix.service.name }}
            type=gha,scope=basyx-docker-release-${{ matrix.service.name }}
            type=registry,ref=${{ matrix.service.image }}:buildcache
          cache-to: |
            type=gha,scope=basyx-docker-release-${{ matrix.service.name }},mode=max
            type=registry,ref=${{ matrix.service.image }}:buildcache,mode=max
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          provenance: mode=max
          sbom: true
          labels: |
            org.opencontainers.image.title=${{ matrix.service.name }}
            org.opencontainers.image.description=Eclipse BaSyx ${{ matrix.service.name }}
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.vendor=Eclipse BaSyx
            org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/README.md
            org.opencontainers.image.created=${{ github.event.release.published_at }}

      - name: Sign image digest (keyless)
        env:
          IMAGE_DIGEST_REF: ${{ matrix.service.image }}@${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          cosign sign --yes "${IMAGE_DIGEST_REF}"

      - name: Extract BuildKit provenance and SBOM predicates
        env:
          IMAGE_DIGEST_REF: ${{ matrix.service.image }}@${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          mkdir -p predicates

          # Multi-platform images expose per-platform data under .Provenance/.SBOM maps.
          if ! docker buildx imagetools inspect "${IMAGE_DIGEST_REF}" --format '{{ json (index .Provenance "linux/amd64").SLSA }}' > predicates/provenance.buildkit.json 2>/dev/null; then
            docker buildx imagetools inspect "${IMAGE_DIGEST_REF}" --format '{{ json .Provenance.SLSA }}' > predicates/provenance.buildkit.json
          fi

          if ! docker buildx imagetools inspect "${IMAGE_DIGEST_REF}" --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > predicates/sbom.buildkit.spdx.json 2>/dev/null; then
            docker buildx imagetools inspect "${IMAGE_DIGEST_REF}" --format '{{ json .SBOM.SPDX }}' > predicates/sbom.buildkit.spdx.json
          fi

          jq -e 'type == "object" and length > 0' predicates/provenance.buildkit.json >/dev/null
          jq -e 'type == "object" and length > 0' predicates/sbom.buildkit.spdx.json >/dev/null

      - name: Detect provenance predicate type
        run: |
          set -euo pipefail
          PROVENANCE_PREDICATE_TYPE=$(jq -r '
            if has("buildDefinition") and has("runDetails") then "https://slsa.dev/provenance/v1"
            elif has("builder") and has("buildType") then "https://slsa.dev/provenance/v0.2"
            else ""
            end
          ' predicates/provenance.buildkit.json)

          if [ -z "${PROVENANCE_PREDICATE_TYPE}" ]; then
            echo "Unsupported BuildKit provenance predicate shape:" >&2
            jq -r 'keys_unsorted | @json' predicates/provenance.buildkit.json >&2
            exit 1
          fi

          echo "Detected provenance predicate type: ${PROVENANCE_PREDICATE_TYPE}"
          echo "PROVENANCE_PREDICATE_TYPE=${PROVENANCE_PREDICATE_TYPE}" >> "$GITHUB_ENV"

      - name: Verify BuildKit OCI attestation manifests exist
        env:
          IMAGE_DIGEST_REF: ${{ matrix.service.image }}@${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          docker buildx imagetools inspect "${IMAGE_DIGEST_REF}" --raw > /tmp/image-index.json
          jq -e '.manifests | map(select(.annotations["vnd.docker.reference.type"] == "attestation-manifest")) | length > 0' /tmp/image-index.json >/dev/null

      - name: Create Cosign attestations from BuildKit predicates
        env:
          IMAGE_DIGEST_REF: ${{ matrix.service.image }}@${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          cosign attest --yes \
            --type "${PROVENANCE_PREDICATE_TYPE}" \
            --predicate predicates/provenance.buildkit.json \
            "${IMAGE_DIGEST_REF}"
          cosign attest --yes \
            --type https://spdx.dev/Document \
            --predicate predicates/sbom.buildkit.spdx.json \
            "${IMAGE_DIGEST_REF}"

      - name: Verify signature and Cosign attestations
        env:
          IMAGE_DIGEST_REF: ${{ matrix.service.image }}@${{ steps.build.outputs.digest }}
          COSIGN_CERT_IDENTITY: https://github.com/eclipse-basyx/basyx-go-components/.github/workflows/docker-release.yml@refs/tags/${{ github.ref_name }}
        run: |
          set -euo pipefail
          cosign verify \
            --certificate-identity "${COSIGN_CERT_IDENTITY}" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "${IMAGE_DIGEST_REF}"
          cosign verify-attestation \
            --type "${PROVENANCE_PREDICATE_TYPE}" \
            --certificate-identity "${COSIGN_CERT_IDENTITY}" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "${IMAGE_DIGEST_REF}" > /tmp/provenance.jsonl
          test -s /tmp/provenance.jsonl
          cosign verify-attestation \
            --type "https://spdx.dev/Document" \
            --certificate-identity "${COSIGN_CERT_IDENTITY}" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "${IMAGE_DIGEST_REF}" > /tmp/sbom-attestation.jsonl
          test -s /tmp/sbom-attestation.jsonl

      - name: Export SPDX and CycloneDX SBOM files
        env:
          IMAGE_DIGEST_REF: ${{ matrix.service.image }}@${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          mkdir -p release-assets
          syft "${IMAGE_DIGEST_REF}" -o "spdx-json=release-assets/${{ matrix.service.name }}-${{ steps.meta.outputs.version }}.spdx.json"
          syft "${IMAGE_DIGEST_REF}" -o "cyclonedx-json=release-assets/${{ matrix.service.name }}-${{ steps.meta.outputs.version }}.cdx.json"

      - name: Write service release metadata
        run: |
          set -euo pipefail
          jq -n \
            --arg service "${{ matrix.service.name }}" \
            --arg image "${{ matrix.service.image }}" \
            --arg digest "${{ steps.build.outputs.digest }}" \
            --arg version "${{ steps.meta.outputs.version }}" \
            --arg tags "${{ steps.meta.outputs.tags }}" \
            --arg signatureIdentity "https://github.com/eclipse-basyx/basyx-go-components/.github/workflows/docker-release.yml@refs/tags/${{ github.ref_name }}" \
            --arg spdx "${{ matrix.service.name }}-${{ steps.meta.outputs.version }}.spdx.json" \
            --arg cyclonedx "${{ matrix.service.name }}-${{ steps.meta.outputs.version }}.cdx.json" \
            '{
              service: $service,
              image: $image,
              digest: $digest,
              version: $version,
              tags: ($tags | split(",")),
              signatureIdentity: $signatureIdentity,
              sbomFiles: {
                spdxJson: $spdx,
                cyclonedxJson: $cyclonedx
              }
            }' > "release-assets/${{ matrix.service.name }}-metadata.json"

      - name: Upload per-service SBOM artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-sbom-${{ matrix.service.name }}
          path: release-assets/*
          retention-days: 30

      - name: Image digest
        run: |
          echo "Built and pushed ${{ matrix.service.image }}"
          echo "Version: ${{ steps.meta.outputs.version }}"
          echo "Tags: ${{ steps.meta.outputs.tags }}"
          echo "Digest: ${{ steps.build.outputs.digest }}"

  attach-release-assets:
    needs: [guard, build-and-push]
    if: ${{ needs.guard.outputs.should-run == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
    steps:
      - name: Download SBOM artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: release-sbom-*
          merge-multiple: true
          path: release-assets

      - name: Generate release supply-chain manifest
        run: |
          set -euo pipefail
          jq -s \
            --arg release "${{ github.ref_name }}" \
            --arg generatedAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            '{
              release: $release,
              generatedAt: $generatedAt,
              services: .
            }' release-assets/*-metadata.json > release-assets/release-supply-chain-manifest.json

      - name: Attach SBOM and manifest assets to release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: |
            release-assets/*.spdx.json
            release-assets/*.cdx.json
            release-assets/*-metadata.json
            release-assets/release-supply-chain-manifest.json