docker-multiarch.yml

name: Docker Multi-Architecture Build

on:
  workflow_call:
    inputs:
      platforms:
        description: 'Target platforms (comma-separated)'
        required: false
        type: string
        default: 'linux/amd64,linux/arm64'
      ubuntu-versions:
        description: 'Ubuntu versions to build (JSON array)'
        required: false
        type: string
        default: '["20.04", "22.04"]'
      push:
        description: 'Push images to registry'
        required: false
        type: boolean
        default: false
      tag:
        description: 'Docker image tag'
        required: true
        type: string
      version:
        description: 'Normalized release version without v prefix'
        required: true
        type: string
      version_series:
        description: 'Major.minor release version series'
        required: true
        type: string
      publish_latest:
        description: 'Publish/move latest tags for a standard tag-push release'
        required: true
        type: boolean
      source_ref:
        description: 'Immutable source ref or SHA to check out for Docker builds'
        required: true
        type: string
      build_recipe_ref:
        description: 'Reviewed workflow commit that supplies the Docker build recipe'
        required: true
        type: string
      dockerhub-username:
        description: 'Docker Hub username'
        required: false
        type: string
        default: ''
      test_run:
        description: 'Test run without pushing'
        required: false
        type: boolean
        default: false
    secrets:
      DOCKERHUB_TOKEN:
        description: 'Docker Hub token'
        required: false
      OP_SERVICE_ACCOUNT_TOKEN:
        description: '1Password service account token'
        required: false
      CARGO_REGISTRIES_TERRAPHIM_TOKEN:
        description: 'Bearer token for the Terraphim Gitea cargo registry'
        required: false

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  DOCKERHUB_IMAGE: terraphim/terraphim-server

jobs:
  # Pre-build frontend to avoid SASS issues in Docker
  build-frontend:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.source_ref }}
          fetch-depth: 1

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 20
          cache: yarn
          cache-dependency-path: desktop/yarn.lock

      - name: Build frontend
        working-directory: ./desktop
        run: |
          yarn install --frozen-lockfile
          yarn build

      - name: Upload frontend artifacts
        uses: actions/upload-artifact@v5
        with:
          name: frontend-dist
          path: desktop/dist/
          retention-days: 1

  build-and-push:
    needs: build-frontend
    runs-on: [self-hosted, Linux, X64]
    strategy:
      fail-fast: false
      matrix:
        ubuntu-version: ${{ fromJSON(inputs.ubuntu-versions) }}
    outputs:
      ghcr-image: ${{ steps.meta-ghcr.outputs.tags }}
      dockerhub-enabled: ${{ steps.dockerhub-check.outputs.enabled }}

    steps:
      - name: Checkout immutable source
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.source_ref }}
          fetch-depth: 1

      - name: Checkout reviewed Docker build recipe
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.build_recipe_ref }}
          path: .release-recipe
          sparse-checkout: docker/Dockerfile.multiarch
          sparse-checkout-cone-mode: false
          fetch-depth: 1

      - name: Overlay reviewed Docker build recipe
        shell: bash
        run: |
          cp .release-recipe/docker/Dockerfile.multiarch docker/Dockerfile.multiarch
          python3 - <<'PY'
          import shutil
          shutil.rmtree('.release-recipe')
          PY

      - name: Download frontend artifacts
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: desktop/dist/

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: all

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver: docker-container
          driver-opts: |
            network=host
          buildkitd-flags: |
            --allow-insecure-entitlement security.insecure
            --allow-insecure-entitlement network.host

      - name: Log in to GitHub Container Registry
        if: inputs.push
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install 1Password CLI
        if: inputs.push
        uses: 1password/install-cli-action@v2
        continue-on-error: true

      - name: Load DockerHub credentials from 1Password
        id: dockerhub-creds
        if: inputs.push
        continue-on-error: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
        run: |
          if [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
            DOCKERHUB_USER=$(op read "op://TerraphimPlatform/DockerHubTokenGithub/username" 2>/dev/null || echo "")
            DOCKERHUB_TOKEN=$(op read "op://TerraphimPlatform/DockerHubTokenGithub/token" 2>/dev/null || echo "")
            if [ -n "$DOCKERHUB_USER" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
              echo "DOCKERHUB_USERNAME=$DOCKERHUB_USER" >> $GITHUB_ENV
              echo "DOCKERHUB_TOKEN=$DOCKERHUB_TOKEN" >> $GITHUB_ENV
              echo "has_dockerhub=true" >> $GITHUB_OUTPUT
              echo "DockerHub credentials loaded from 1Password"
            else
              echo "has_dockerhub=false" >> $GITHUB_OUTPUT
              echo "DockerHub credentials not found in 1Password"
            fi
          else
            echo "has_dockerhub=false" >> $GITHUB_OUTPUT
            echo "No 1Password token available"
          fi

      - name: Check DockerHub availability
        id: dockerhub-check
        run: |
          if [ -n "${{ env.DOCKERHUB_TOKEN }}" ] || [ -n "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
            echo "enabled=true" >> $GITHUB_OUTPUT
          else
            echo "enabled=false" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
        if: inputs.push && steps.dockerhub-check.outputs.enabled == 'true'
        uses: docker/login-action@v4
        with:
          username: ${{ env.DOCKERHUB_USERNAME || inputs.dockerhub-username }}
          password: ${{ env.DOCKERHUB_TOKEN || secrets.DOCKERHUB_TOKEN }}
        continue-on-error: true

      - name: Extract metadata for GHCR
        id: meta-ghcr
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ inputs.tag }}-ubuntu${{ matrix.ubuntu-version }}
            type=raw,value=${{ inputs.version }}-ubuntu${{ matrix.ubuntu-version }}
            type=raw,value=${{ inputs.version_series }}-ubuntu${{ matrix.ubuntu-version }},enable=${{ inputs.publish_latest }}
            type=raw,value=latest-ubuntu${{ matrix.ubuntu-version }},enable=${{ inputs.publish_latest }}
          labels: |
            org.opencontainers.image.title=Terraphim Server
            org.opencontainers.image.description=Privacy-first AI assistant with semantic search
            org.opencontainers.image.vendor=Terraphim AI
            ubuntu.version=${{ matrix.ubuntu-version }}

      - name: Extract metadata for DockerHub
        id: meta-dockerhub
        if: steps.dockerhub-check.outputs.enabled == 'true'
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.DOCKERHUB_IMAGE }}
          tags: |
            type=raw,value=${{ inputs.tag }}-ubuntu${{ matrix.ubuntu-version }}
            type=raw,value=${{ inputs.version }}-ubuntu${{ matrix.ubuntu-version }}
            type=raw,value=${{ inputs.version_series }}-ubuntu${{ matrix.ubuntu-version }},enable=${{ inputs.publish_latest }}
            type=raw,value=latest-ubuntu${{ matrix.ubuntu-version }},enable=${{ inputs.publish_latest }}
          labels: |
            org.opencontainers.image.title=Terraphim Server
            org.opencontainers.image.description=Privacy-first AI assistant with semantic search
            org.opencontainers.image.vendor=Terraphim AI
            ubuntu.version=${{ matrix.ubuntu-version }}

      - name: Prepare Terraphim cargo registry token for Docker build
        id: cargo-registry-token
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          CARGO_REGISTRIES_TERRAPHIM_TOKEN: ${{ secrets.CARGO_REGISTRIES_TERRAPHIM_TOKEN }}
        run: |
          TOKEN=""
          if [ -n "${CARGO_REGISTRIES_TERRAPHIM_TOKEN}" ]; then
            TOKEN="${CARGO_REGISTRIES_TERRAPHIM_TOKEN}"
          elif [ -n "${OP_SERVICE_ACCOUNT_TOKEN}" ]; then
            GITEA_TOKEN="$(op read "op://TerraphimPlatform/gitea-test-token/credential" 2>/dev/null || true)"
            if [ -n "${GITEA_TOKEN}" ]; then
              TOKEN="Bearer ${GITEA_TOKEN}"
            fi
          fi
          if [ -z "${TOKEN}" ]; then
            echo "::error::Terraphim cargo registry token unavailable (set CARGO_REGISTRIES_TERRAPHIM_TOKEN or OP_SERVICE_ACCOUNT_TOKEN)"
            exit 1
          fi
          echo "::add-mask::${TOKEN}"
          printf '%s' "${TOKEN}" > "${RUNNER_TEMP}/cargo_registry_token"
          echo "token_file=${RUNNER_TEMP}/cargo_registry_token" >> "${GITHUB_OUTPUT}"

      - name: Document transient BuildKit EOF recovery
        env:
          SOURCE_REF: ${{ inputs.source_ref }}
        run: |
          echo "Known transient BuildKit EOF: rerun the failed Docker job manually after verifying the source_ref remains $SOURCE_REF." >> "$GITHUB_STEP_SUMMARY"
          echo "No automatic reusable-workflow retry is configured for this recovery path." >> "$GITHUB_STEP_SUMMARY"

      - name: Build and push to GHCR
        uses: docker/build-push-action@v7
        with:
          context: .
          file: docker/Dockerfile.multiarch
          platforms: ${{ inputs.platforms }}
          push: ${{ inputs.push }}
          tags: ${{ steps.meta-ghcr.outputs.tags }}
          labels: ${{ steps.meta-ghcr.outputs.labels }}
          build-args: |
            UBUNTU_VERSION=${{ matrix.ubuntu-version }}
            RUST_VERSION=1.92.0
          secret-files: |
            cargo_registry_token=${{ steps.cargo-registry-token.outputs.token_file }}
          no-cache: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false
          sbom: false

      - name: Build and push to DockerHub
        if: inputs.push && steps.dockerhub-check.outputs.enabled == 'true'
        uses: docker/build-push-action@v7
        continue-on-error: true  # DockerHub is optional, don't fail if unavailable
        with:
          context: .
          file: docker/Dockerfile.multiarch
          platforms: ${{ inputs.platforms }}
          push: true
          tags: ${{ steps.meta-dockerhub.outputs.tags }}
          labels: ${{ steps.meta-dockerhub.outputs.labels }}
          build-args: |
            UBUNTU_VERSION=${{ matrix.ubuntu-version }}
            RUST_VERSION=1.92.0
          secret-files: |
            cargo_registry_token=${{ steps.cargo-registry-token.outputs.token_file }}
          no-cache: true
          cache-from: type=gha
          provenance: false
          sbom: false

      - name: Verify GHCR build
        if: inputs.push
        run: |
          echo "Verifying multi-architecture build for Ubuntu ${{ matrix.ubuntu-version }}:"
          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.tag }}-ubuntu${{ matrix.ubuntu-version }}

      - name: Verify DockerHub build
        if: inputs.push && steps.dockerhub-check.outputs.enabled == 'true'
        continue-on-error: true  # DockerHub is optional
        run: |
          echo "Verifying DockerHub build for Ubuntu ${{ matrix.ubuntu-version }}:"
          docker buildx imagetools inspect ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.tag }}-ubuntu${{ matrix.ubuntu-version }} || true

  # Publish unsuffixed release manifests from the Ubuntu 22.04 images.
  publish-release-manifests:
    needs: build-and-push
    runs-on: [self-hosted, Linux, X64]
    if: inputs.push && !inputs.test_run

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install 1Password CLI
        uses: 1password/install-cli-action@v2
        continue-on-error: true

      - name: Load DockerHub credentials from 1Password
        id: dockerhub-creds
        continue-on-error: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
        run: |
          if [ -n "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
            DOCKERHUB_USER=$(op read "op://TerraphimPlatform/DockerHubTokenGithub/username" 2>/dev/null || echo "")
            DOCKERHUB_TOKEN=$(op read "op://TerraphimPlatform/DockerHubTokenGithub/token" 2>/dev/null || echo "")
            if [ -n "$DOCKERHUB_USER" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
              echo "DOCKERHUB_USERNAME=$DOCKERHUB_USER" >> $GITHUB_ENV
              echo "DOCKERHUB_TOKEN=$DOCKERHUB_TOKEN" >> $GITHUB_ENV
              echo "has_dockerhub=true" >> $GITHUB_OUTPUT
            fi
          fi

      - name: Log in to Docker Hub
        if: steps.dockerhub-creds.outputs.has_dockerhub == 'true'
        uses: docker/login-action@v4
        with:
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}
        continue-on-error: true

      - name: Publish release manifests for GHCR
        run: |
          docker buildx imagetools create \
            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.tag }} \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.tag }}-ubuntu22.04

          docker buildx imagetools create \
            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version }} \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version }}-ubuntu22.04

          if [[ "${{ inputs.publish_latest }}" == "true" ]]; then
            docker buildx imagetools create \
              --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version_series }} \
              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version_series }}-ubuntu22.04

            docker buildx imagetools create \
              --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest-ubuntu22.04
          fi

      - name: Publish release manifests for DockerHub
        if: steps.dockerhub-creds.outputs.has_dockerhub == 'true'
        run: |
          docker buildx imagetools create \
            --tag ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.tag }} \
            ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.tag }}-ubuntu22.04 || true

          docker buildx imagetools create \
            --tag ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.version }} \
            ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.version }}-ubuntu22.04 || true

          if [[ "${{ inputs.publish_latest }}" == "true" ]]; then
            docker buildx imagetools create \
              --tag ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.version_series }} \
              ${{ env.DOCKERHUB_IMAGE }}:${{ inputs.version_series }}-ubuntu22.04 || true

            docker buildx imagetools create \
              --tag ${{ env.DOCKERHUB_IMAGE }}:latest \
              ${{ env.DOCKERHUB_IMAGE }}:latest-ubuntu22.04 || true
          fi

  build-summary:
    needs: [build-frontend, build-and-push, publish-release-manifests]
    runs-on: [self-hosted, Linux, X64]
    if: always()

    steps:
      - name: Build Summary
        run: |
          echo "## Docker Multi-Architecture Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Build Status" >> $GITHUB_STEP_SUMMARY
          echo "| Ubuntu Version | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|---------------|--------|" >> $GITHUB_STEP_SUMMARY

          UBUNTU_VERSIONS='${{ inputs.ubuntu-versions }}'
          for version in $(echo $UBUNTU_VERSIONS | jq -r '.[]'); do
            if [[ "${{ needs.build-and-push.result }}" == "success" ]]; then
              echo "| $version | Success |" >> $GITHUB_STEP_SUMMARY
            else
              echo "| $version | Failed |" >> $GITHUB_STEP_SUMMARY
            fi
          done

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Configuration" >> $GITHUB_STEP_SUMMARY
          echo "- **Platforms:** ${{ inputs.platforms }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Push to Registry:** ${{ inputs.push }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Tag:** ${{ inputs.tag }}" >> $GITHUB_STEP_SUMMARY

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Images" >> $GITHUB_STEP_SUMMARY
          echo "- **GHCR immutable:** \`ghcr.io/${{ env.IMAGE_NAME }}:${{ inputs.tag }}\`, \`ghcr.io/${{ env.IMAGE_NAME }}:${{ inputs.version }}\`" >> $GITHUB_STEP_SUMMARY
          if [[ "${{ inputs.publish_latest }}" == "true" ]]; then
            echo "- **GHCR moving:** \`ghcr.io/${{ env.IMAGE_NAME }}:${{ inputs.version_series }}\`, \`ghcr.io/${{ env.IMAGE_NAME }}:latest\`" >> $GITHUB_STEP_SUMMARY
          fi
          if [[ "${{ needs.build-and-push.outputs.dockerhub-enabled }}" == "true" ]]; then
            echo "- **DockerHub immutable:** \`${{ env.DOCKERHUB_IMAGE }}:${{ inputs.tag }}\`, \`${{ env.DOCKERHUB_IMAGE }}:${{ inputs.version }}\`" >> $GITHUB_STEP_SUMMARY
            if [[ "${{ inputs.publish_latest }}" == "true" ]]; then
              echo "- **DockerHub moving:** \`${{ env.DOCKERHUB_IMAGE }}:${{ inputs.version_series }}\`, \`${{ env.DOCKERHUB_IMAGE }}:latest\`" >> $GITHUB_STEP_SUMMARY
            fi
          fi