name: Reusable Docker Publish

# Multi-arch (v1.9.0+): builds a manifest list for `platforms` (amd64 + arm64 by default) with
# `docker buildx`, so the same tag runs on x86 servers and on the arm64 Raspberry Pi nodes with no
# per-host changes. The Trivy gate is preserved by building the native amd64 image first with
# --load, scanning that locally, and only then building + pushing the multi-arch manifest (the
# amd64 layers are reused from cache, so only arm64 is newly built).
#
# Runner requirements (baked into the PipelineImage runner; the workflow also self-installs as a
# fallback): the `docker buildx` plugin, and a build daemon that permits `--privileged` containers
# so QEMU/binfmt can be registered for cross-building arm64 on an amd64 runner.

on:
  workflow_call:
    inputs:
      image_name:
        required: true
        type: string
      dockerfile_path:
        type: string
        default: "."
      floating_tag:
        type: string
        default: "edge"
      platforms:
        # target platforms for the manifest list. Override to a single platform (e.g.
        # "linux/amd64") for images that do not need to run on the arm64 nodes.
        type: string
        default: "linux/amd64,linux/arm64"
      run_image_scan:
        type: boolean
        default: true
      scan_severity:
        type: string
        default: "HIGH,CRITICAL"
      use_private_index:
        # pass the private Gitea PyPI index into the build as a BuildKit secret, for images
        # whose Dockerfile installs the in-house BB* packages. The Dockerfile must consume it
        # via `RUN --mount=type=secret,id=pip_extra_index`, never as an ARG or ENV, so the
        # token is not baked into an image layer.
        type: boolean
        default: false
    secrets:
      REGISTRY_USERNAME: { required: true }
      REGISTRY_PASSWORD: { required: true }
      DOCKER_REGISTRY: { required: true }
      NTFY_TOPIC: { required: true }
      NTFY_TOKEN: { required: true }
      NTFY_SERVER: { required: true }
      PIP_EXTRA_INDEX_URL: { required: false }

# Pinned build tooling. Keep in sync with the ARGs in the PipelineImage Dockerfiles.
# buildx: verify the binary against checksums.txt from the buildx GitHub release before bumping.
# binfmt: pin by digest (tonistiigi/binfmt@sha256:...) for the strongest posture; the version tag
# below is immutable enough for CI and avoids a Docker Hub token dance in the workflow.
env:
  BUILDX_VERSION: "0.35.0"
  BUILDX_SHA256: "d41ece72044243b4f58b343441ae37446d9c29a7d6b5e11c61847bbcf8f7dfda"
  BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
  TRIVY_VERSION: "0.72.0"
  TRIVY_SHA256: "bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea"

jobs:
  publish:
    runs-on: docker
    container:
      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
      credentials:
        username: ${{ secrets.REGISTRY_USERNAME }}
        password: ${{ secrets.REGISTRY_PASSWORD }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract Tags
        id: vars
        shell: bash
        run: |
          set -euo pipefail
          SHA_SHORT="$(git rev-parse --short HEAD)"
          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"

          # the SHA tag is always built; it is also the target Trivy scans before any push
          PUSH_TAGS="-t ${FULL_IMAGE}:${SHA_SHORT} -t ${FULL_IMAGE}:${{ inputs.floating_tag }}"

          if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
            VERSION="${{ gitea.ref_name }}"
            VERSION="${VERSION#v}"
            MAJOR="$(echo "$VERSION" | cut -d. -f1)"
            MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
            PUSH_TAGS="${PUSH_TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
          fi

          echo "scan_ref=${FULL_IMAGE}:${SHA_SHORT}" >> "$GITEA_OUTPUT"
          echo "push_tags=${PUSH_TAGS}" >> "$GITEA_OUTPUT"
          echo "full_image=${FULL_IMAGE}" >> "$GITEA_OUTPUT"

      - name: Docker Login
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: Set up Docker Buildx and QEMU
        shell: bash
        env:
          PLATFORMS: ${{ inputs.platforms }}
        run: |
          set -euo pipefail

          # Ensure the buildx plugin. Baked into the runner image (PipelineImage); this fallback
          # covers older runners, mirroring the Trivy fallback below. Pinned + checksum-verified.
          if ! docker buildx version >/dev/null 2>&1; then
            echo "=== buildx not in runner image, installing v${BUILDX_VERSION} ==="
            mkdir -p /usr/libexec/docker/cli-plugins
            curl -sSfLo /usr/libexec/docker/cli-plugins/docker-buildx \
              "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
            echo "${BUILDX_SHA256}  /usr/libexec/docker/cli-plugins/docker-buildx" | sha256sum -c -
            chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
          fi
          docker buildx version

          # Register QEMU so this amd64 runner can cross-build the non-native platforms. binfmt is
          # a kernel concern, so it cannot live in the runner image and is installed here against
          # the build daemon (needs --privileged).
          if echo "${PLATFORMS}" | grep -q 'arm'; then
            echo "=== Registering QEMU emulators (${BINFMT_IMAGE}) ==="
            docker run --privileged --rm "${BINFMT_IMAGE}" --install arm64
          fi

          # A docker-container builder is required for multi-platform output (the default docker
          # driver builds a single platform only). Idempotent across re-runs on a warm runner.
          docker buildx inspect multiarch >/dev/null 2>&1 || \
            docker buildx create --name multiarch --driver docker-container --bootstrap
          docker buildx use multiarch

      - name: Build image for vulnerability scan
        if: ${{ inputs.run_image_scan }}
        shell: bash
        env:
          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
        run: |
          set -euo pipefail

          SECRET_ARGS=""
          if [ "${{ inputs.use_private_index }}" = "true" ]; then
            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
              exit 1
            fi
            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
          fi

          # native amd64 only, loaded into the local image store so Trivy can scan it before
          # anything is pushed. The amd64 result is cached and reused by the multi-arch push.
          # CVEs live in the base image and OS/Python packages, which are identical across arches,
          # so scanning amd64 is a faithful gate for the whole manifest list.
          DOCKER_BUILDKIT=1 docker buildx build \
            --load \
            --platform linux/amd64 \
            ${SECRET_ARGS} \
            -t "${{ steps.vars.outputs.scan_ref }}" \
            ${{ inputs.dockerfile_path }}

      - name: Image Vulnerability Scan
        if: ${{ inputs.run_image_scan }}
        shell: bash
        run: |
          set -euo pipefail

          # Fallback for runner images without Trivy baked in. Pinned version +
          # checksum, never "latest": Trivy releases were compromised in the
          # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
          # with the ARGs in the PipelineImage Dockerfiles.
          if ! command -v trivy >/dev/null 2>&1; then
            echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
            curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
            echo "${TRIVY_SHA256}  trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | sha256sum -c -
            tar -xzf "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy
            rm "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
          fi
          trivy --version

          echo "=== Scanning ${{ steps.vars.outputs.scan_ref }} (fail on fixable ${{ inputs.scan_severity }}) ==="
          trivy image \
            --exit-code 1 \
            --severity "${{ inputs.scan_severity }}" \
            --ignore-unfixed \
            --scanners vuln,secret \
            "${{ steps.vars.outputs.scan_ref }}"

      - name: Build and push multi-arch image
        shell: bash
        env:
          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
        run: |
          set -euxo pipefail

          echo "=== Git / Ref Info ==="
          git rev-parse HEAD
          echo "gitea.ref=${{ gitea.ref }}"
          echo "gitea.ref_name=${{ gitea.ref_name }}"
          echo "platforms=${{ inputs.platforms }}"

          SECRET_ARGS=""
          if [ "${{ inputs.use_private_index }}" = "true" ]; then
            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
              exit 1
            fi
            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
          fi

          # one build produces every platform and pushes a manifest list per tag. The Trivy gate
          # above already ran on the amd64 image these layers are reused from, so a scan failure
          # aborts the job before this step. On a version tag this also pushes latest/major/minor.
          DOCKER_BUILDKIT=1 docker buildx build \
            --push \
            --platform "${{ inputs.platforms }}" \
            ${SECRET_ARGS} \
            ${{ steps.vars.outputs.push_tags }} \
            ${{ inputs.dockerfile_path }}

      - name: Verify pushed manifest
        shell: bash
        run: |
          set -euo pipefail
          # confirm the pushed tag really is a multi-arch manifest list
          docker buildx imagetools inspect "${{ steps.vars.outputs.scan_ref }}"