build.yml

---
name: Build Multi-Architecture Docker Image

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]
  workflow_dispatch: null  # Allow manual triggers
  schedule:
    - cron: '20 17 * * *'  # Sets Semgrep to scan every day at 17:20 UTC.

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  DOCKER_BUILDKIT: 1

permissions:
  contents: read
  packages: write
  security-events: write
  id-token: write

jobs:
  pre-commit:
    name: pre-commit
    runs-on: ubuntu-latest
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'
      - name: Cache poetry dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/pypoetry
            .venv
          key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-poetry-
      - name: Install dependencies
        run: |
          pip install poetry
          poetry install
          pip install pre-commit
      - name: Run pre-commit
        run: pre-commit run --all-files --show-diff-on-failure

  semgrep:
    name: semgrep-oss/scan
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v4

      - name: Run full Semgrep scan
        run: >
          semgrep scan --metrics=off --config "p/default" --sarif >
          semgrep.sarif

      - name: Check for high severity issues
        run: >
          semgrep scan --metrics=off --config "p/default" --error
          --severity=ERROR
        continue-on-error: false

      - name: Upload SARIF file
        uses: actions/upload-artifact@v4
        with:
          name: semgrep-results
          path: semgrep.sarif
          retention-days: 7

  build-buildx:
    needs: [pre-commit, semgrep]
    if: github.event_name != 'schedule'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:v0.12.0

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix={{branch}}-
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build multi-architecture image (Buildx) - With Cache Fallback
        uses: docker/build-push-action@v5
        continue-on-error: true
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          load: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      - name: Build multi-architecture image (Buildx) - With Registry Cache
        if: failure()
        uses: docker/build-push-action@v5
        continue-on-error: true
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          load: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: >
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cache
          cache-to: >
            type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cache,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      - name: Build multi-architecture image (Buildx) - Without Cache
        if: failure()
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          load: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      - name: Test multi-architecture image (Buildx)
        run: |
          echo "🧪 Testing AMD64 architecture..."

          # Try with GHA cache first
          if docker buildx build --platform linux/amd64 --load -t test-amd64 . \
            --cache-from type=gha; then
            echo "✅ Build with GHA cache successful"
          else
            echo "⚠️  GHA cache failed, trying with registry cache..."
            if docker buildx build --platform linux/amd64 --load -t test-amd64 . \
              --cache-from type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cache; then
              echo "✅ Build with registry cache successful"
            else
              echo "⚠️  Registry cache failed, building without cache..."
              docker buildx build --platform linux/amd64 --load -t test-amd64 . --no-cache
            fi
          fi

          echo "🧪 Running AMD64 container test..."
          docker run --rm --platform linux/amd64 test-amd64 \
            python -c "import sys; print('AMD64 test passed')" || \
            exit 1

          # Clean up test images
          docker rmi test-amd64 2>/dev/null || true
          echo "✅ AMD64 test completed successfully"

  # Kaniko build removed - Buildx provides better multi-architecture support
  # and is sufficient for all use cases

  show-build-summary:
    needs: [build-buildx]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Show build summary
        run: |
          echo "✅ Build and push completed successfully"
          echo "📦 Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          echo "🚀 Multi-architecture images pushed to registry"
          echo "🔒 Security: Semgrep scanning enabled"
          echo "🏗️  Built with Docker Buildx (AMD64 + ARM64)"
          echo "💾 Cache: Multi-tier fallback strategy implemented"
          echo "   - Primary: GitHub Actions Cache (GHA)"
          echo "   - Fallback 1: Registry Cache"
          echo "   - Fallback 2: No Cache (slower but reliable)"
          echo "🛡️  Resilient to GHA cache outages"