docker.yml

# .github/workflows/docker.yml — Docker image + Helm chart publishing
#
# Triggers:
#   - Pull request: build Docker image (single platform) + lint Helm chart
#   - Push to main: build + push Docker image (multi-arch, latest + sha)
#   - Tag v*:       build + push Docker image (multi-arch) + package + push Helm chart (if changed)
#
# Published to:
#   - Docker: ghcr.io/block/schemabot:<tag>
#   - Helm:   oci://ghcr.io/block/charts/schemabot:<version>

name: Docker & Helm

on:
  push:
    tags: ["v*"]
    branches: [main]
  pull_request:
  # Required status checks must also report on the merge queue, or the queue
  # waits forever. The build runs to validate; pushes stay gated on push events,
  # so the queue never publishes. Inert until a repo admin enables the queue.
  merge_group:

permissions: {}

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # See test.yaml for the rationale of this docs-only skip pattern.
  # On PRs that touch only docs/**, the chart lint and Docker build are
  # skipped. Pushes to main and tags always build (so latest/tagged images
  # are published regardless of the diff content).
  changes:
    name: "Detect changes"
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      code: ${{ steps.out.outputs.code }}
    steps:
      - name: "Detect non-docs changes"
        if: github.event_name == 'pull_request'
        id: filter
        continue-on-error: true
        uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # dorny/paths-filter@v3.0.3
        with:
          filters: |
            code:
              - '**'
              - '!**/*.md'
              - '!docs/**'
      - name: "Resolve code-change flag"
        id: out
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          FILTER_OUTCOME: ${{ steps.filter.outcome }}
          FILTER_CODE: ${{ steps.filter.outputs.code }}
        run: |
          if [ "$EVENT_NAME" != "pull_request" ]; then
            echo "code=true" >> "$GITHUB_OUTPUT"
          elif [ "$FILTER_OUTCOME" != "success" ]; then
            echo "::warning::paths-filter failed; running CI instead of skipping"
            echo "code=true" >> "$GITHUB_OUTPUT"
          else
            echo "code=$FILTER_CODE" >> "$GITHUB_OUTPUT"
          fi

  lint-chart:
    needs: changes
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && needs.changes.outputs.code == 'true'
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # azure/setup-helm@v4

      - name: Lint Helm chart
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # helm/chart-testing-action@v2.7.0

      - name: Run chart-testing lint
        env:
          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: ct lint --target-branch "$BASE_REF" --charts charts/schemabot

      - name: Check chart version bump
        run: |
          # If any chart files changed, Chart.yaml version must be bumped.
          CHANGED=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD -- 'charts/schemabot/')
          if [ -z "$CHANGED" ]; then
            echo "No chart changes detected, skipping version check."
            exit 0
          fi

          BASE_VERSION=$(git show origin/${{ github.event.pull_request.base.ref }}:charts/schemabot/Chart.yaml 2>/dev/null | grep '^version:' | awk '{print $2}')
          HEAD_VERSION=$(grep '^version:' charts/schemabot/Chart.yaml | awk '{print $2}')

          if [ "$BASE_VERSION" = "$HEAD_VERSION" ]; then
            echo "::error::Chart files changed but charts/schemabot/Chart.yaml version was not bumped (still ${HEAD_VERSION}). Bump the version before merging."
            exit 1
          fi
          echo "Chart version bumped: ${BASE_VERSION} → ${HEAD_VERSION}"

  build-and-push:
    needs: changes
    runs-on: ubuntu-latest
    # Skip on PRs that touch only docs/**. Pushes (main and tags) always run
    # so latest and tagged images are published regardless of diff content.
    if: >-
      github.repository == 'block/schemabot' &&
      (github.event_name != 'pull_request' || needs.changes.outputs.code == 'true')
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Create config files from examples
        run: |
          for dir in deploy/aws-multi-env/staging deploy/aws-multi-env/production; do
            if [ -f "$dir/config.yaml.example" ] && [ ! -f "$dir/config.yaml" ]; then
              cp "$dir/config.yaml.example" "$dir/config.yaml"
            fi
          done

      - name: Set up QEMU
        if: github.event_name == 'push'
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        if: github.event_name == 'push'
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # docker/metadata-action@v5
        id: meta
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=
            type=semver,pattern=v{{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Create config files from examples
        run: |
          for dir in deploy/aws-multi-env/staging deploy/aws-multi-env/production; do
            if [ -f "$dir/config.yaml.example" ] && [ ! -f "$dir/config.yaml" ]; then
              cp "$dir/config.yaml.example" "$dir/config.yaml"
            fi
          done

      - name: Build and push Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # docker/build-push-action@v6
        with:
          context: .
          file: deploy/Dockerfile
          # Multi-arch only when publishing (push/tag); single platform on PRs
          # and in the merge queue for speed (those validate the build, no push)
          platforms: ${{ github.event_name == 'push' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            VERSION=${{ github.ref_name }}
            COMMIT=${{ github.sha }}
            BUILD_DATE=${{ github.event.head_commit.timestamp || github.event.pull_request.updated_at || github.run_started_at }}

      # LocalScale image — fake PlanetScale API for testing.
      # Published to ghcr.io/block/schemabot/localscale:<sha|latest>
      - name: "Build LocalScale binary"
        run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o bin/localscale-linux ./cmd/localscale

      - name: "Extract LocalScale metadata"
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # docker/metadata-action@v5
        id: localscale-meta
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/localscale
          tags: |
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}

      - name: "Build and push LocalScale image"
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # docker/build-push-action@v6
        with:
          context: .
          file: deploy/local/Dockerfile.localscale
          platforms: linux/amd64
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.localscale-meta.outputs.tags }}
          labels: ${{ steps.localscale-meta.outputs.labels }}

      # Helm chart publishing — only on tags and only if chart files changed
      - name: Check for chart changes
        if: startsWith(github.ref, 'refs/tags/v')
        id: chart-changes
        run: |
          PREV_TAG=$(git tag --sort=-v:refname | grep '^v' | sed -n '2p')
          if [ -z "$PREV_TAG" ]; then
            echo "First tag — publishing chart"
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if git diff --quiet "$PREV_TAG" -- charts/; then
            echo "No chart changes since $PREV_TAG — skipping Helm publish"
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "Chart changes detected since $PREV_TAG — publishing"
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Install Helm
        if: startsWith(github.ref, 'refs/tags/v') && steps.chart-changes.outputs.changed == 'true'
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # azure/setup-helm@v4

      - name: Package and push Helm chart
        if: startsWith(github.ref, 'refs/tags/v') && steps.chart-changes.outputs.changed == 'true'
        run: |
          CHART_VERSION=$(grep '^version:' charts/schemabot/Chart.yaml | awk '{print $2}')
          helm package charts/schemabot --destination ./build
          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
          helm push ./build/schemabot-${CHART_VERSION}.tgz oci://ghcr.io/block/charts