docker.yml

name: Build & Push Docker Images

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/openmapx

# Least-privilege default; each job opts into the extra scopes it needs
# (the build job adds packages: write + security-events: write).
permissions:
  contents: read

jobs:
  changes:
    name: Detect changed apps
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      apps: ${{ steps.set.outputs.apps }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - id: filter
        if: github.event_name != 'workflow_dispatch'
        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
        with:
          filters: |
            api:
              - '.github/workflows/docker.yml'
              - 'apps/api/**'
              - 'packages/**'
              - 'integrations/**'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'package.json'
              - 'apps/api/Dockerfile'
            web:
              - '.github/workflows/docker.yml'
              - 'apps/web/**'
              - 'packages/**'
              - 'integrations/**'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'package.json'
              - 'apps/web/Dockerfile'
            data-manager:
              - '.github/workflows/docker.yml'
              - 'services/data-manager/**'
              - 'packages/**'
              - 'integrations/**'
              - 'pnpm-lock.yaml'
              - 'pnpm-workspace.yaml'
              - 'package.json'
            transitous-tools:
              - '.github/workflows/docker.yml'
              - 'services/motis/tools/transitous/**'
            docs:
              - '.github/workflows/docker.yml'
              - 'docs/**'

      - id: set
        env:
          DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
          FILTER_CHANGES: ${{ steps.filter.outputs.changes }}
        run: |
          if [ "$DISPATCH" = "true" ]; then
            echo 'apps=["api","web","data-manager","transitous-tools","docs"]' >> "$GITHUB_OUTPUT"
          else
            echo "apps=${FILTER_CHANGES}" >> "$GITHUB_OUTPUT"
          fi

  build:
    name: Build ${{ matrix.app }}
    needs: changes
    if: needs.changes.outputs.apps != '[]' && needs.changes.outputs.apps != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        app: ${{ fromJSON(needs.changes.outputs.apps) }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Resolve build context
        id: ctx
        env:
          APP: ${{ matrix.app }}
        run: |
          case "$APP" in
            api)
              echo "context=." >> "$GITHUB_OUTPUT"
              echo "dockerfile=apps/api/Dockerfile" >> "$GITHUB_OUTPUT"
              ;;
            web)
              echo "context=." >> "$GITHUB_OUTPUT"
              echo "dockerfile=apps/web/Dockerfile" >> "$GITHUB_OUTPUT"
              ;;
            data-manager)
              echo "context=." >> "$GITHUB_OUTPUT"
              echo "dockerfile=services/data-manager/Dockerfile" >> "$GITHUB_OUTPUT"
              ;;
            transitous-tools)
              echo "context=services/motis/tools/transitous" >> "$GITHUB_OUTPUT"
              echo "dockerfile=services/motis/tools/transitous/Dockerfile" >> "$GITHUB_OUTPUT"
              ;;
            docs)
              echo "context=docs" >> "$GITHUB_OUTPUT"
              echo "dockerfile=docs/Dockerfile" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "Unknown app: $APP" >&2
              exit 1
              ;;
          esac

      # Buildx startup pulls its BuildKit image from Docker Hub. A transient
      # registry timeout should not sink one matrix leg while the others pass.
      - name: Set up Docker Buildx
        id: buildx
        continue-on-error: true
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Retry Docker Buildx setup
        if: steps.buildx.outcome == 'failure'
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        id: meta
        with:
          images: ${{ env.IMAGE_PREFIX }}/${{ matrix.app }}
          tags: |
            type=sha,prefix=
            type=raw,value=latest

      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        id: build
        with:
          context: ${{ steps.ctx.outputs.context }}
          file: ${{ steps.ctx.outputs.dockerfile }}
          platforms: linux/amd64
          # Stamp the web service worker with the commit SHA so each deploy
          # produces a fresh sw.js and the PWA's update prompt fires. Ignored by
          # the other images (their Dockerfiles declare no such ARG).
          build-args: ${{ matrix.app == 'web' && format('SW_BUILD_ID={0}', github.sha) || '' }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,scope=${{ matrix.app }}
          cache-to: type=gha,mode=max,scope=${{ matrix.app }}
          provenance: mode=max
          sbom: true

      # Trivy scan + SARIF upload require Code Scanning, which needs
      # GitHub Advanced Security on private repos. To enable: make the
      # repo public OR set repo variable ENABLE_CODE_SCANNING=true
      # under Settings → Secrets and variables → Actions → Variables.
      - name: Scan image with Trivy
        if: vars.ENABLE_CODE_SCANNING == 'true'
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ env.IMAGE_PREFIX }}/${{ matrix.app }}@${{ steps.build.outputs.digest }}
          format: sarif
          output: trivy-${{ matrix.app }}.sarif
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          exit-code: "0"

      - name: Upload Trivy results
        if: always() && vars.ENABLE_CODE_SCANNING == 'true'
        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
        with:
          sarif_file: trivy-${{ matrix.app }}.sarif
          category: trivy-${{ matrix.app }}