docker.yml

# SPDX-FileCopyrightText: 2025 Knitli Inc.
# SPDX-FileContributor: Adam Poulemanos <adam@knit.li>
#
# SPDX-License-Identifier: MIT OR Apache-2.0

name: Docker Build and Publish
on:
  push:
    branches:
      - main
      - staging
    tags:
      - v*.*.*
    paths:
      - src/**
      - packages/**
      - Dockerfile
      - docker-compose.yml
      - .dockerignore
      - pyproject.toml
      - .github/workflows/docker.yml
      - uv.lock
  pull_request:
    branches:
      - main
      - staging
    paths:
      - src/**
      - packages/**
      - Dockerfile
      - docker-compose.yml
      - .dockerignore
      - pyproject.toml
      - .github/workflows/docker.yml
      - uv.lock
  workflow_dispatch:
    inputs:
      update_description_only:
        description: Only update Docker Hub description (no build)
        required: false
        type: boolean
        default: false
env:
  REGISTRY: docker.io
  IMAGE_NAME: knitli/codeweaver
permissions:
  contents: read
jobs:
  # Update Docker Hub description only (manual trigger)
  update-description:
    name: Update Docker Hub Description
    runs-on: ubuntu-latest
    if: github.event.inputs.update_description_only == 'true'
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@b3498302c5c423fa896b97a26bb183df735d08f8
      - name: Update Docker Hub description
        uses: peter-evans/dockerhub-description@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: ${{ env.IMAGE_NAME }}
          readme-filepath: ./DOCKER.md
          short-description: The missing abstraction layer between AI and your code - deep, structural understanding for better AI results
      - name: Confirmation
        run: echo "✅ Docker Hub description updated successfully!"
  # Build and test Docker image
  build:
    name: Build Docker Image
    runs-on: ubuntu-latest
    if: github.event.inputs.update_description_only != 'true'
    permissions:
      contents: read
      packages: write
    # Continue even if tests fail (SSL issues in CI are known)
    continue-on-error: true
    steps:
      - name: Checkout code
        uses: actions/checkout@b3498302c5c423fa896b97a26bb183df735d08f8
        with:
          fetch-depth: 0 # Full history for versioning
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
        with:
          install: true
      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            # Branch-based tags
            type=ref,event=branch
            # PR tags
            type=ref,event=pr
            # Semantic versioning tags from git tags
            # Note: PEP 440 versions (e.g., 0.1.0a1) may not parse correctly with semver
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            # Raw version extraction for PEP 440 pre-release versions (e.g., v0.1.0a1)
            type=match,pattern=v(.*),group=1
            # Latest tag for main branch (only for stable releases, not pre-releases)
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            # SHA for traceability (only on branch/tag builds, not PRs)
            type=sha,prefix=sha-
      - name: Build Docker image
        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85
        with:
          context: .
          file: ./Dockerfile
          push: false
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ github.ref_name }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
            VCS_REF=${{ github.sha }}
      - name: Test Docker image
        run: |
          echo "Testing Docker image build..."
          # Get the first tag from the metadata output
          IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1)
          echo "Testing image: $IMAGE_TAG"

          # Test that image was built
          docker images "$IMAGE_TAG"

          # Test that image can start (basic smoke test)
          # Note: This will fail without proper config, but we're just checking it starts
          docker run --rm --entrypoint /bin/sh "$IMAGE_TAG" -c "codeweaver --version" || true
      - name: Save Docker image for testing
        if: github.event_name == 'pull_request'
        run: |
          IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1)
          docker save "$IMAGE_TAG" -o /tmp/codeweaver-image.tar
      - name: Upload Docker image artifact
        if: github.event_name == 'pull_request'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: docker-image
          path: /tmp/codeweaver-image.tar
          retention-days: 7

  # Publish to Docker Hub (only on main branch or tags)
  publish:
    name: Publish to Docker Hub
    runs-on: ubuntu-latest
    needs:
      - build
    # Only publish if build succeeded; test-compose can fail due to SSL issues
    if: |
      github.event.inputs.update_description_only != 'true' &&
      github.event_name != 'pull_request' &&
      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) &&
      needs.build.result == 'success'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@b3498302c5c423fa896b97a26bb183df735d08f8
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
      - name: Log in to Docker Hub
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            # Semantic versioning tags from git tags
            # Note: PEP 440 versions (e.g., 0.1.0a1) may not parse correctly with semver
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            # Raw version extraction for PEP 440 pre-release versions (e.g., v0.1.0a1)
            type=match,pattern=v(.*),group=1
            # Latest tag for main branch (only for stable releases, not pre-releases)
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
            # SHA for traceability
            type=sha,prefix=sha-
      - name: Build and push Docker image
        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64
          build-args: |
            VERSION=${{ github.ref_name }}
            BUILD_DATE=${{ github.event.head_commit.timestamp }}
            VCS_REF=${{ github.sha }}
      - name: Update Docker Hub description
        uses: peter-evans/dockerhub-description@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: ${{ env.IMAGE_NAME }}
          readme-filepath: ./DOCKER.md
          short-description: The missing abstraction layer between AI and your code - deep, structural understanding for better AI results
      - name: Generate image summary
        run: |
          {
            echo "## Docker Image Published"
            echo ""
            echo "**Repository:** ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
            echo "**Tags:**"
            echo '```'
            echo "${{ steps.meta.outputs.tags }}"
            echo '```'
            echo ""
            echo "**Pull command:**"
            echo '```bash'
            echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"