docker-build.yml

name: Auto Build on Docker Image Tag Change

on:
  push:
    branches: [ main, develop ]  # Adjust branches as needed
    paths:
      - '.env'
  workflow_dispatch:
    inputs:
      compose_profiles:
        description: 'Docker Compose profiles to build (comma-separated)'
        required: false
        default: 'desktop,isaac-sim,ms-airsim'
        type: string

env:
  DEFAULT_PROFILES: 'desktop,isaac-sim,ms-airsim'

jobs:
  check-docker-tag-change:
    runs-on: ubuntu-latest
    outputs:
      tag-changed: ${{ steps.check-changes.outputs.tag-changed }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 2  # Fetch current and previous commit
          submodules: recursive

      - name: Check if VERSION changed
        id: check-changes
        run: |
          # Get the current VERSION value
          CURRENT_TAG=$(grep "^VERSION=" .env | cut -d '=' -f2- | tr -d '"' | tr -d "'")
          
          # Get the previous VERSION value
          git show HEAD~1:.env > .env.prev 2>/dev/null || echo "" > .env.prev
          PREVIOUS_TAG=$(grep "^VERSION=" .env.prev | cut -d '=' -f2- | tr -d '"' | tr -d "'" || echo "")
          
          echo "Current tag: $CURRENT_TAG"
          echo "Previous tag: $PREVIOUS_TAG"
          
          if [ "$CURRENT_TAG" != "$PREVIOUS_TAG" ] && [ -n "$CURRENT_TAG" ]; then
            echo "VERSION has changed from '$PREVIOUS_TAG' to '$CURRENT_TAG'"
            echo "tag-changed=true" >> $GITHUB_OUTPUT
          else
            echo "VERSION has not changed"
            echo "tag-changed=false" >> $GITHUB_OUTPUT
          fi

  docker-build:
    needs: check-docker-tag-change
    if: github.event_name == 'workflow_dispatch' || needs.check-docker-tag-change.outputs.tag-changed == 'true'
    runs-on: [self-hosted, airstack-ephemeral]
    timeout-minutes: 120
    permissions:
      contents: read
      id-token: write  # Required for keyless cosign signing via GitHub OIDC
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Log in to Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.DOCKER_REGISTRY_URL }}  # e.g., your-registry.com or leave empty for Docker Hub
          username: ${{ vars.DOCKER_REGISTRY_USERNAME }}
          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}

      - name: Verify .env file and extract tag
        run: |
          # Ensure .env file exists and is readable
          if [ ! -f .env ]; then
            echo "Error: .env file not found"
            exit 1
          fi

      - name: Create dummy omni_pass.env
        run: |
          # Some compose files expect this file to exist, even if it is empty.
          mkdir -p simulation/isaac-sim/docker
          : > simulation/isaac-sim/docker/omni_pass.env
          
          # Display the current VERSION for debugging
          DOCKER_TAG=$(grep "^VERSION=" .env | cut -d '=' -f2- | tr -d '"' | tr -d "'")
          echo "Building with VERSION: $DOCKER_TAG"
          
          if [ -z "$DOCKER_TAG" ]; then
            echo "Error: VERSION is empty"
            exit 1
          fi

      - name: Run Docker Compose Build
        run: |
          # Load environment variables and run docker compose build
          set -a  # Export all variables
          source .env
          set +a  # Stop exporting
          
          # Always override COMPOSE_PROFILES for all trigger types
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            export COMPOSE_PROFILES="${{ github.event.inputs.compose_profiles || env.DEFAULT_PROFILES }}"
          else
            export COMPOSE_PROFILES="${{ env.DEFAULT_PROFILES }}"
          fi
          
          docker compose build

      - name: Run Docker Compose Push
        run: |
          # Load environment variables and run docker compose push
          set -a  # Export all variables
          source .env
          set +a  # Stop exporting
          
          # Always override COMPOSE_PROFILES for all trigger types
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            export COMPOSE_PROFILES="${{ github.event.inputs.compose_profiles || env.DEFAULT_PROFILES }}"
          else
            export COMPOSE_PROFILES="${{ env.DEFAULT_PROFILES }}"
          fi
          
          docker compose push

      - name: Sign pushed images with Cosign (keyless)
        env:
          COSIGN_YES: "true"
        run: |
          set -a
          source .env
          set +a

          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            export COMPOSE_PROFILES="${{ github.event.inputs.compose_profiles || env.DEFAULT_PROFILES }}"
          else
            export COMPOSE_PROFILES="${{ env.DEFAULT_PROFILES }}"
          fi

          IMAGES=$(docker compose config --images | sort -u)
          if [ -z "$IMAGES" ]; then
            echo "No images resolved from compose config; nothing to sign."
            exit 1
          fi

          for IMG in $IMAGES; do
            DIGEST=$(docker buildx imagetools inspect "$IMG" --format '{{.Manifest.Digest}}')
            if [ -z "$DIGEST" ]; then
              echo "Error: could not resolve digest for $IMG"
              exit 1
            fi
            REPO="${IMG%:*}"
            REF="${REPO}@${DIGEST}"
            echo "Signing $REF"
            cosign sign "$REF"
          done

      - name: Verify Cosign signatures
        run: |
          set -a
          source .env
          set +a

          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            export COMPOSE_PROFILES="${{ github.event.inputs.compose_profiles || env.DEFAULT_PROFILES }}"
          else
            export COMPOSE_PROFILES="${{ env.DEFAULT_PROFILES }}"
          fi

          IMAGES=$(docker compose config --images | sort -u)
          for IMG in $IMAGES; do
            DIGEST=$(docker buildx imagetools inspect "$IMG" --format '{{.Manifest.Digest}}')
            REPO="${IMG%:*}"
            REF="${REPO}@${DIGEST}"
            echo "Verifying $REF"
            cosign verify "$REF" \
              --certificate-identity-regexp "^https://github\\.com/${{ github.repository }}/\\.github/workflows/docker-build\\.yml@" \
              --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
              > /dev/null
          done

      - name: Optional - Run Docker Compose Up (uncomment if needed)
        run: |
          # Uncomment the following lines if you also want to start the services
          # set -a
          # source .env  
          # set +a
          # docker compose up -d

  notify:
    needs: [check-docker-tag-change, docker-build]
    if: always() && (github.event_name == 'workflow_dispatch' || needs.check-docker-tag-change.outputs.tag-changed == 'true')
    runs-on: ubuntu-latest
    steps:
      - name: Notify build and push result
        run: |
          if [ "${{ needs.docker-build.result }}" == "success" ]; then
            echo "✅ Docker Compose build and push completed successfully"
          else
            echo "❌ Docker Compose build or push failed"
            exit 1
          fi