prop/.forgejo/workflows/build.yaml

name: Build and Push

on:
  push:
    branches:
      - main

env:
  REGISTRY: git.mcintire.me
  OWNER: graham
  IMAGE_NAME: prop
  CI_IMAGE_NAME: prop-ci
  DOCKER_CLI_VERSION: '28.5.2'
  BUILDX_VERSION: '0.35.0'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Build and push the CI test image first. The test step in the next job
  # needs prop-ci:latest with EXLA precompiled to avoid OOM-killing g++.
  build-ci-image:
    name: Build CI test image
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Docker CLI and buildx
        run: |
          set -euo pipefail
          curl -fsSL --retry 3 --retry-delay 2 \
            "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_CLI_VERSION}.tgz" \
            | tar xz --strip-components=1 -C /usr/local/bin docker/docker
          mkdir -p "$HOME/.docker/cli-plugins"
          curl -fsSL --retry 3 --retry-delay 2 \
            -o "$HOME/.docker/cli-plugins/docker-buildx" \
            "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
          chmod +x "$HOME/.docker/cli-plugins/docker-buildx"
          docker version
          docker buildx version

      - name: Build and push CI image
        env:
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
        run: |
          set -euo pipefail

          IMAGE="${REGISTRY}/${OWNER}/${CI_IMAGE_NAME}"
          SHA_TAG="${GITHUB_SHA::7}"

          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$OWNER" --password-stdin

          DOCKER_BUILDKIT=1 docker build \
            --file Dockerfile.ci \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            --cache-from "${IMAGE}:latest" \
            --tag "${IMAGE}:${SHA_TAG}" \
            --tag "${IMAGE}:latest" \
            .

          docker push "${IMAGE}:${SHA_TAG}"
          docker push "${IMAGE}:latest"

          docker image rm "${IMAGE}:${SHA_TAG}" "${IMAGE}:latest" 2>/dev/null || true
          docker logout "$REGISTRY" || true

  build-and-push:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    needs: build-ci-image

    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install Docker CLI and buildx
        run: |
          set -euo pipefail
          curl -fsSL --retry 3 --retry-delay 2 \
            "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_CLI_VERSION}.tgz" \
            | tar xz --strip-components=1 -C /usr/local/bin docker/docker
          mkdir -p "$HOME/.docker/cli-plugins"
          curl -fsSL --retry 3 --retry-delay 2 \
            -o "$HOME/.docker/cli-plugins/docker-buildx" \
            "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
          chmod +x "$HOME/.docker/cli-plugins/docker-buildx"
          docker version
          docker buildx version

      - name: Verify compilation
        run: |
          set -euo pipefail
          tar --exclude='_build' --exclude='deps' --exclude='.git' \
              --exclude='priv/static/assets' --exclude='assets/node_modules' \
              --exclude='rust' --exclude='target' \
              -cf - . | \
          docker run --rm -i \
            -e MIX_ENV=prod \
            -w /app \
            docker.io/hexpm/elixir:1.20.1-erlang-29.0.2-debian-trixie-20260518-slim \
              sh -euc '\
              mkdir -p /app && cd /app && tar xf - && \
              export DEBIAN_FRONTEND=noninteractive && \
              apt-get update -qq && apt-get install -y -qq git curl ca-certificates build-essential cdo && \
              mix local.hex --force && \
              mix local.rebar --force && \
              mix deps.get --only prod && \
              mix deps.compile && \
              mix assets.setup && \
              mix compile --warnings-as-errors'

      - name: Build CI test image locally
        run: |
          set -euo pipefail
          # Build the CI image from the current Dockerfile.ci. Use the
          # registry image for layer caching so repeated builds are fast.
          # The build-ci-image pre-req job keeps the cache warm.
          CI_IMAGE="${REGISTRY}/${OWNER}/${CI_IMAGE_NAME}"
          DOCKER_BUILDKIT=1 docker build \
            --file Dockerfile.ci \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            --cache-from "${CI_IMAGE}:latest" \
            --tag prop-ci:local \
            .

      - name: Run tests
        run: |
          set -euo pipefail
          tar --exclude='_build' --exclude='deps' --exclude='.git' \
              --exclude='priv/static/assets' --exclude='assets/node_modules' \
              --exclude='rust' --exclude='target' \
              -cf - . | \
          docker run --rm -i \
            -e MIX_ENV=test \
            --network host \
            -w /app \
            prop-ci:local \
              sh -euc '\
              mkdir -p /app && cd /app && tar xf - && \
              mix deps.get && \
              if [ -d /opt/exla-cache/cache/0.13.0 ]; then \
                rm -rf /app/deps/exla/cache && \
                cp -a /opt/exla-cache/cache /app/deps/exla/cache; \
                echo "Restored pre-built EXLA cache"; \
              else \
                echo "No pre-built EXLA cache found, will compile from source"; \
              fi && \
              mix ecto.create --quiet && \
              mix ecto.migrate --quiet && \
              mix test'

      - name: Build and push
        env:
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
        run: |
          set -euo pipefail

          IMAGE="${REGISTRY}/${OWNER}/${IMAGE_NAME}"
          SHA_TAG="main-$(date -u +%s)-${GITHUB_SHA::7}"

          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$OWNER" --password-stdin

          DOCKER_BUILDKIT=1 docker build \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            --cache-from "${IMAGE}:latest" \
            --tag "${IMAGE}:${SHA_TAG}" \
            --tag "${IMAGE}:latest" \
            .

          docker push "${IMAGE}:${SHA_TAG}"
          docker push "${IMAGE}:latest"

          {
            echo "### Image pushed"
            echo ""
            echo "- \`${IMAGE}:${SHA_TAG}\`"
            echo "- \`${IMAGE}:latest\`"
          } >> "$GITHUB_STEP_SUMMARY"

          docker image rm "${IMAGE}:${SHA_TAG}" "${IMAGE}:latest" 2>/dev/null || true
          docker logout "$REGISTRY" || true