name: Build & Publish Docker Image on: push: branches: [main] tags: ["v*"] pull_request: branches: [main] workflow_dispatch: env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} # Cancel in-progress runs when a new commit is pushed to the same ref. concurrency: group: docker-publish-${{ github.ref }} cancel-in-progress: true jobs: build-and-push: name: Build & push multi-arch image runs-on: ubuntu-latest # 30 min wall clock — a healthy multi-arch build finishes inside 17 min # (see v1.4.7..v1.4.13 history). The v1.4.14 main run hung 47 min on # `[linux/amd64 runner 2/14]` before Marc cancelled because tag + branch # were exporting to the same gha cache scope concurrently (see fix below). # 30 min is enough for a clean build + a slow exporter, while still # rescuing the runner if buildkit deadlocks instead of waiting for a # human to notice. timeout-minutes: 30 permissions: contents: read packages: write steps: - name: Checkout uses: actions/checkout@v4 - name: Set up QEMU (multi-arch) uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 # Skip login on PRs from forks — they don't have package:write. # Image is built but not pushed in that case. - name: Log in to GitHub Container Registry if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Compute image tags & labels id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=raw,value=latest,enable={{is_default_branch}} type=sha,prefix=sha-,format=short labels: | org.opencontainers.image.title=HealthLog org.opencontainers.image.description=Self-hosted health-tracking PWA org.opencontainers.image.licenses=AGPL-3.0-only org.opencontainers.image.source=https://github.com/${{ github.repository }} # Per-ref gha cache scope: previously both `cache-from: type=gha` and # `cache-to: type=gha,mode=max` used buildx's default scope name # (`buildkit`). When a release commit lands, GitHub fires the workflow # twice in parallel — once for the `main` push, once for the `v*` tag # — both pointed at the same SHA, both writing to the same gha cache # key. mode=max exports every stage of every platform; the concurrent # writers race on the cache manifest and one deadlocks. The v1.4.14 # main run sat on `[linux/amd64 runner 2/14] RUN apk add tzdata` for # 47 minutes (cancelled by hand) while the tag run on the same SHA # finished cleanly in 17 minutes — clear smoking-gun. # # Splitting the scope by `github.ref_name` (e.g. `main`, `v1.4.15`, # `pr-123`) gives each invocation its own cache slot. We `cache-from` # both the ref-specific scope AND the canonical `main` scope so: # - feature branches/tags can warm-start off main's last good build # - a tag built right after a main push hits main's cache for layer # reuse without contending on writes - name: Build & push image uses: docker/build-push-action@v6 with: context: . file: ./Dockerfile platforms: linux/amd64,linux/arm64 push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: | type=gha,scope=build-${{ github.ref_name }} type=gha,scope=build-main cache-to: type=gha,mode=max,scope=build-${{ github.ref_name }} provenance: true sbom: true # Phase C2 (v1.4.15): trigger Coolify deploy automatically once GHCR has # the new image. Removes the manual SSH + force-pull recipe documented # in `.planning/phase-8-report.md`. # # Runs only on the publish path (push to `main` or to a `v*` tag), never # on PRs. `continue-on-error: true` because the image is *already* # published to GHCR by the time we reach this step — a Coolify-side # outage must not retroactively fail the build. Marc still has the # manual recipe as fallback. # # Required GitHub repository secrets (set by Marc once): # COOLIFY_WEBHOOK = full deploy URL incl. ?uuid=...&force=false # COOLIFY_TOKEN = Bearer token from Coolify UI -> Keys & Tokens # Both secrets are referenced exclusively here. If either is unset, the # step short-circuits to a skip rather than calling Coolify with empty # auth. - name: Trigger Coolify deploy if: github.event_name != 'pull_request' continue-on-error: true env: COOLIFY_WEBHOOK: ${{ secrets.COOLIFY_WEBHOOK }} COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }} run: | if [ -z "$COOLIFY_WEBHOOK" ] || [ -z "$COOLIFY_TOKEN" ]; then echo "::warning::COOLIFY_WEBHOOK or COOLIFY_TOKEN secret missing — skipping auto-deploy. Configure in repo Settings → Secrets to enable." exit 0 fi echo "Triggering Coolify deploy for ref ${{ github.ref_name }} (sha ${GITHUB_SHA::7})" response=$(curl --silent --show-error --max-time 30 \ --write-out "\n__HTTP_STATUS__:%{http_code}" \ --request GET "$COOLIFY_WEBHOOK" \ --header "Authorization: Bearer $COOLIFY_TOKEN") status="${response##*__HTTP_STATUS__:}" body="${response%__HTTP_STATUS__:*}" echo "Coolify response (HTTP $status):" echo "$body" if [ "$status" -lt 200 ] || [ "$status" -ge 300 ]; then echo "::error::Coolify deploy webhook returned HTTP $status — image is published, but auto-deploy did not fire. Marc: deploy manually via SSH recipe in .planning/phase-8-report.md." exit 1 fi echo "Coolify deploy queued — awaiting outgoing notification webhook to /api/internal/deploy-webhook for final status."