HealthLog/.github/workflows/docker-publish.yml

name: Build & Publish Docker Image

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

# Cancel in-progress runs when a new commit is pushed to the same ref.
concurrency:
  group: docker-publish-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-push:
    name: Build & push multi-arch image
    runs-on: ubuntu-latest
    # 30 min wall clock — a healthy multi-arch build finishes inside 17 min
    # (see v1.4.7..v1.4.13 history). The v1.4.14 main run hung 47 min on
    # `[linux/amd64 runner 2/14]` before Marc cancelled because tag + branch
    # were exporting to the same gha cache scope concurrently (see fix below).
    # 30 min is enough for a clean build + a slow exporter, while still
    # rescuing the runner if buildkit deadlocks instead of waiting for a
    # human to notice.
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU (multi-arch)
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Skip login on PRs from forks — they don't have package:write.
      # Image is built but not pushed in that case.
      - name: Log in to GitHub Container Registry
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute image tags & labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,prefix=sha-,format=short
          labels: |
            org.opencontainers.image.title=HealthLog
            org.opencontainers.image.description=Self-hosted health-tracking PWA
            org.opencontainers.image.licenses=AGPL-3.0-only
            org.opencontainers.image.source=https://github.com/${{ github.repository }}

      # Per-ref gha cache scope: previously both `cache-from: type=gha` and
      # `cache-to: type=gha,mode=max` used buildx's default scope name
      # (`buildkit`). When a release commit lands, GitHub fires the workflow
      # twice in parallel — once for the `main` push, once for the `v*` tag
      # — both pointed at the same SHA, both writing to the same gha cache
      # key. mode=max exports every stage of every platform; the concurrent
      # writers race on the cache manifest and one deadlocks. The v1.4.14
      # main run sat on `[linux/amd64 runner 2/14] RUN apk add tzdata` for
      # 47 minutes (cancelled by hand) while the tag run on the same SHA
      # finished cleanly in 17 minutes — clear smoking-gun.
      #
      # Splitting the scope by `github.ref_name` (e.g. `main`, `v1.4.15`,
      # `pr-123`) gives each invocation its own cache slot. We `cache-from`
      # both the ref-specific scope AND the canonical `main` scope so:
      #   - feature branches/tags can warm-start off main's last good build
      #   - a tag built right after a main push hits main's cache for layer
      #     reuse without contending on writes
      - name: Build & push image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha,scope=build-${{ github.ref_name }}
            type=gha,scope=build-main
          cache-to: type=gha,mode=max,scope=build-${{ github.ref_name }}
          provenance: true
          sbom: true

      # Phase C2 (v1.4.15): trigger Coolify deploy automatically once GHCR has
      # the new image. Removes the manual SSH + force-pull recipe documented
      # in `.planning/phase-8-report.md`.
      #
      # Runs only on the publish path (push to `main` or to a `v*` tag), never
      # on PRs. `continue-on-error: true` because the image is *already*
      # published to GHCR by the time we reach this step — a Coolify-side
      # outage must not retroactively fail the build. Marc still has the
      # manual recipe as fallback.
      #
      # Required GitHub repository secrets (set by Marc once):
      #   COOLIFY_WEBHOOK = full deploy URL incl. ?uuid=...&force=false
      #   COOLIFY_TOKEN   = Bearer token from Coolify UI -> Keys & Tokens
      # Both secrets are referenced exclusively here. If either is unset, the
      # step short-circuits to a skip rather than calling Coolify with empty
      # auth.
      - name: Trigger Coolify deploy
        if: github.event_name != 'pull_request'
        continue-on-error: true
        env:
          COOLIFY_WEBHOOK: ${{ secrets.COOLIFY_WEBHOOK }}
          COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }}
        run: |
          if [ -z "$COOLIFY_WEBHOOK" ] || [ -z "$COOLIFY_TOKEN" ]; then
            echo "::warning::COOLIFY_WEBHOOK or COOLIFY_TOKEN secret missing — skipping auto-deploy. Configure in repo Settings → Secrets to enable."
            exit 0
          fi
          echo "Triggering Coolify deploy for ref ${{ github.ref_name }} (sha ${GITHUB_SHA::7})"
          response=$(curl --silent --show-error --max-time 30 \
            --write-out "\n__HTTP_STATUS__:%{http_code}" \
            --request GET "$COOLIFY_WEBHOOK" \
            --header "Authorization: Bearer $COOLIFY_TOKEN")
          status="${response##*__HTTP_STATUS__:}"
          body="${response%__HTTP_STATUS__:*}"
          echo "Coolify response (HTTP $status):"
          echo "$body"
          if [ "$status" -lt 200 ] || [ "$status" -ge 300 ]; then
            echo "::error::Coolify deploy webhook returned HTTP $status — image is published, but auto-deploy did not fire. Marc: deploy manually via SSH recipe in .planning/phase-8-report.md."
            exit 1
          fi
          echo "Coolify deploy queued — awaiting outgoing notification webhook to /api/internal/deploy-webhook for final status."