pr-preview.yml

name: PR Preview Build

on:
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number (e.g. 123)'
        required: true
        type: number
      variant:
        description: 'Dockerfile variant'
        required: false
        type: choice
        options:
          - default
          - kiro
          - unified
          - agentcore
          - antigravity
          - claude
          - codex
          - copilot
          - cursor
          - devin
          - gemini
          - grok
          - hermes
          - kimi
          - mimocode
          - native
          - opencode
          - pi
        default: 'default'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  resolve-pr:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      ref: ${{ steps.pr.outputs.ref }}
      repo: ${{ steps.pr.outputs.repo }}
      dockerfile: ${{ steps.df.outputs.file }}
      suffix: ${{ steps.df.outputs.suffix }}
      build_args: ${{ steps.df.outputs.build_args }}
      tag_suffix: ${{ steps.df.outputs.tag_suffix }}
      target: ${{ steps.df.outputs.target }}
    steps:
      - name: Get PR branch
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ inputs.pr_number }}
        run: |
          PR_JSON=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")
          echo "ref=$(echo "$PR_JSON" | jq -r '.head.ref')" >> "$GITHUB_OUTPUT"
          echo "repo=$(echo "$PR_JSON" | jq -r '.head.repo.full_name')" >> "$GITHUB_OUTPUT"

      - name: Resolve Dockerfile
        id: df
        env:
          VARIANT: ${{ inputs.variant }}
        run: |
          if [ "$VARIANT" = "default" ]; then
            echo "file=Dockerfile" >> "$GITHUB_OUTPUT"
            echo "suffix=" >> "$GITHUB_OUTPUT"
            echo "build_args=" >> "$GITHUB_OUTPUT"
            echo "tag_suffix=" >> "$GITHUB_OUTPUT"
            echo "target=" >> "$GITHUB_OUTPUT"
          elif [ "$VARIANT" = "kiro" ]; then
            # Unified build (all platforms) tagged as :pr<N>-kiro
            echo "file=Dockerfile" >> "$GITHUB_OUTPUT"
            echo "suffix=" >> "$GITHUB_OUTPUT"
            echo "build_args=BUILD_MODE=unified" >> "$GITHUB_OUTPUT"
            echo "tag_suffix=-kiro" >> "$GITHUB_OUTPUT"
            echo "target=" >> "$GITHUB_OUTPUT"
          elif [ "$VARIANT" = "unified" ]; then
            # Same base Dockerfile as "default", but built with BUILD_MODE=unified
            # so the telegram/line/feishu/wecom/googlechat/teams gateway adapters
            # (Cargo feature `unified`) are actually compiled in. The "default"
            # variant builds with openab's default Cargo features only
            # (discord/slack/...), which does NOT include telegram — a PR
            # touching the unified gateway path needs this variant to test
            # against a real webhook, not "default".
            echo "file=Dockerfile" >> "$GITHUB_OUTPUT"
            echo "suffix=" >> "$GITHUB_OUTPUT"
            echo "build_args=BUILD_MODE=unified" >> "$GITHUB_OUTPUT"
            echo "tag_suffix=" >> "$GITHUB_OUTPUT"
            echo "target=" >> "$GITHUB_OUTPUT"
          else
            # Unified Dockerfile with --target for agent-specific variants.
            # Image: ghcr.io/openabdev/openab:pr<N>-<variant>
            echo "file=Dockerfile.unified" >> "$GITHUB_OUTPUT"
            echo "suffix=" >> "$GITHUB_OUTPUT"
            echo "build_args=" >> "$GITHUB_OUTPUT"
            echo "tag_suffix=-${VARIANT}" >> "$GITHUB_OUTPUT"
            echo "target=${VARIANT}" >> "$GITHUB_OUTPUT"
          fi

  build:
    needs: resolve-pr
    strategy:
      matrix:
        platform:
          - { os: linux/amd64, runner: ubuntu-latest }
          - { os: linux/arm64, runner: ubuntu-24.04-arm }
    runs-on: ${{ matrix.platform.runner }}
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
        with:
          repository: ${{ needs.resolve-pr.outputs.repo }}
          ref: ${{ needs.resolve-pr.outputs.ref }}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ needs.resolve-pr.outputs.dockerfile }}
          target: ${{ needs.resolve-pr.outputs.target || '' }}
          platforms: ${{ matrix.platform.os }}
          build-args: ${{ needs.resolve-pr.outputs.build_args }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ needs.resolve-pr.outputs.suffix }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=pr-${{ inputs.variant }}-${{ matrix.platform.os }}
          cache-to: type=gha,scope=pr-${{ inputs.variant }}-${{ matrix.platform.os }},mode=max

      - name: Export digest
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ matrix.platform.runner }}
          path: /tmp/digests/*
          retention-days: 1

  merge:
    needs: [resolve-pr, build]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Create manifest list
        env:
          SUFFIX: ${{ needs.resolve-pr.outputs.suffix }}
          TAG_SUFFIX: ${{ needs.resolve-pr.outputs.tag_suffix }}
          PR_NUMBER: ${{ inputs.pr_number }}
        run: |
          IMAGE="${REGISTRY}/${IMAGE_NAME}${SUFFIX}"
          docker buildx imagetools create \
            -t "${IMAGE}:pr${PR_NUMBER}${TAG_SUFFIX}" \
            $(printf "${IMAGE}@sha256:%s " $(ls /tmp/digests/))