sencho/.github/workflows/docker-preview.yml

name: Publish PR Preview Image

# ---------------------------------------------------------------------------
# Preview build  vs  integration (dev)  vs  release
# ---------------------------------------------------------------------------
# Maintainer-triggered Docker Hub images for external validation BEFORE a PR
# merges. Testers pull saelix/sencho:pr-<N> without GHCR credentials.
#
#   Preview (this file)                  Integration (docker-dev.yml)
#   ---------------------                ---------------------------
#   trigger: workflow_dispatch           trigger: push to main
#   registry: Docker Hub only             registry: GHCR only
#   image:  saelix/sencho                 image: ghcr.io/.../sencho-dev
#   tags:   :pr-<N>, :preview-<sha>       tags: :dev, :dev-<sha>
#   signing / SBOM / Release: no          signing / SBOM / Release: no
#   approval gate: preview environment   approval gate: none
#
# Release tags (latest, semver), cosign, SBOM/VEX, and GitHub Releases are
# RELEASE-ONLY in docker-publish.yml. Preview tags never use latest or semver.
# ---------------------------------------------------------------------------

on:
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number to build and publish (tags pr-N and preview-sha)'
        required: true
        type: number

concurrency:
  group: docker-preview-pr-${{ inputs.pr_number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  push_preview_image:
    name: Build and push preview image to Docker Hub
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # DOCKERHUB_USERNAME and DOCKERHUB_TOKEN live in the `preview` environment
    # (same Hub repo as production, but no release approval gate). Copy both
    # secrets from the production environment when bootstrapping preview.
    environment: preview
    steps:
      - name: Validate PR number
        env:
          PR_NUMBER: ${{ inputs.pr_number }}
        run: |
          set -euo pipefail
          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]] || [ "$PR_NUMBER" -lt 1 ]; then
            echo "pr_number must be a positive integer"
            exit 1
          fi

      - name: Resolve pull request
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ inputs.pr_number }}
        run: |
          set -euo pipefail
          pr_json=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")
          state=$(echo "$pr_json" | jq -r '.state')
          head_sha=$(echo "$pr_json" | jq -r '.head.sha')
          if [ "$state" != "open" ]; then
            echo "PR #${PR_NUMBER} is not open (state=${state})"
            exit 1
          fi
          echo "head_sha=${head_sha}" >> "$GITHUB_OUTPUT"
          echo "Building PR #${PR_NUMBER} at ${head_sha}"

      - name: Check out the repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: refs/pull/${{ inputs.pr_number }}/head

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Compute daily apk cache bust value
        id: apk-bust
        run: echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"

      - name: Log in to Docker Hub
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: saelix/sencho
          tags: |
            type=raw,value=pr-${{ inputs.pr_number }}
            type=sha,prefix=preview-,format=short

      - name: Validate preview tags before publish
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          PR_NUMBER: ${{ inputs.pr_number }}
        run: |
          set -euo pipefail
          if [ -z "${TAGS// }" ]; then
            echo "No tags generated for publish"
            exit 1
          fi
          while IFS= read -r full_ref; do
            [ -n "$full_ref" ] || continue
            tag="${full_ref##*:}"
            if [ "$tag" = "latest" ]; then
              echo "Refusing to publish reserved tag: latest"
              exit 1
            fi
            if [[ "$tag" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || [[ "$tag" =~ ^[0-9]+\.[0-9]+$ ]]; then
              echo "Refusing to publish semver-like tag: ${tag}"
              exit 1
            fi
            if [ "$tag" = "dev" ] || [[ "$tag" == dev-* ]]; then
              echo "Refusing to publish dev integration tag: ${tag}"
              exit 1
            fi
            if [[ "$tag" == "pr-${PR_NUMBER}" ]]; then
              continue
            fi
            if [[ "$tag" =~ ^preview-[0-9a-f]+$ ]]; then
              continue
            fi
            echo "Refusing to publish unexpected tag: ${tag}"
            exit 1
          done <<< "$TAGS"

      - name: Build preview image for pre-publish scan (amd64, loaded)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          push: false
          load: true
          platforms: linux/amd64
          tags: localhost/sencho:preview-scan
          cache-from: type=gha
          build-args: |
            APK_CACHE_BUST=${{ steps.apk-bust.outputs.date }}

      - name: Scan preview image for vulnerabilities (Trivy)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: localhost/sencho:preview-scan
          exit-code: '1'
          severity: 'CRITICAL,HIGH'
          format: 'table'
          trivy-config: trivy.yaml

      - name: Smoke test preview image (pre-publish)
        run: |
          set -euo pipefail
          docker run --rm --entrypoint sh localhost/sencho:preview-scan -c \
            'docker --version && docker compose version'

          docker run -d --name sencho-preview-smoke -p 1852:1852 localhost/sencho:preview-scan
          trap 'docker logs sencho-preview-smoke 2>&1 || true; docker rm -f sencho-preview-smoke >/dev/null 2>&1 || true' EXIT
          for i in $(seq 1 30); do
            if curl -fsS http://localhost:1852/api/health >/dev/null 2>&1; then
              echo "Container healthy after ${i}s"
              curl -s http://localhost:1852/api/health
              exit 0
            fi
            sleep 1
          done
          echo "FAILED: /api/health did not become ready within 30s"
          exit 1

      - name: Build and push preview image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            APK_CACHE_BUST=${{ steps.apk-bust.outputs.date }}