docker-release.yml

name: 🚀 Release & Docker Build

on:
  push:
    branches: [main]
    paths-ignore:
      - '.github/**'
      - '*.md'
      - 'docs/**'
      - 'examples/**'
  pull_request:
    branches: [main]
    paths:
      - 'src/**'
      - 'tests/**'
      - 'pyproject.toml'
      - 'Dockerfile'
      - 'docker-compose*.yml'
      - '.dockerignore'
      - '.env.example'
      - 'scripts/**'
      - '.github/workflows/docker-release.yml'
  workflow_dispatch:
    inputs:
      force-release:
        description: 'force create release'
        type: boolean
        default: false

permissions:
  contents: write
  issues: write
  pull-requests: write
  packages: write
  security-events: write
  # Required by docker-build.yml@main: a declared permissions: block sets every
  # unlisted scope to none, and the reusable workflow now needs these three.
  attestations: write   # write the build-provenance attestation
  id-token: write       # OIDC token to sign the attestation (keyless/Sigstore)
  actions: read         # its nested security-analysis job reads run metadata

jobs:
  # ============================================
  # Validation Jobs
  # ============================================

  validate-compose:
    name: 🔍 Validate Docker Compose
    uses: bauer-group/automation-templates/.github/workflows/modules-validate-compose.yml@main
    with:
      # Sidecar is the shipped deliverable of this repo; the standalone example's
      # database exists only for local testing, so CI validates the sidecar file.
      compose-file: 'docker-compose.sidecar.yml'
      env-file: '.env.example'
      # `backup` is deliberately profiles:[backup] (on-demand), so it is absent
      # from `docker compose config` and cannot be a required service here. This
      # is a syntax/render check; once the shared workflow is profile-aware it
      # can assert 'backup' via an activated profile.
      validate-services: '[]'

  validate-scripts:
    name: 🔍 Validate Shell Scripts
    uses: bauer-group/automation-templates/.github/workflows/modules-validate-shellscript.yml@main
    with:
      scan-directory: '.'
      severity: 'error'

  # amd64 keeps the check name "🧪 Pytest"; arm64 runs on GitHub's hosted Arm
  # runner (free for public repositories), as the released image is multi-arch.
  test:
    name: 🧪 Pytest${{ matrix.arch == 'arm64' && ' (arm64)' || '' }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: '3.14'
      - name: Install
        run: pip install -e ".[test]"
      - name: Run tests
        run: pytest tests/ -q

  # Real backup -> restore round trips through the engine image itself (its own
  # pg_dump/pg_restore and mariadb-dump/mariadb clients) against real servers:
  # scripts/e2e.sh on docker-compose.e2e.yml, one suite per leg so they run in
  # parallel. The engines suite runs against the server images of that file
  # ("compose", Dependabot keeps them current), the oldest lines the fleet runs
  # ("lts"), the newest releases ("latest") and MariaDB 11.8, so a server the
  # engine cannot back up blocks the release before a consumer meets it. The
  # feature suites deliver alerts, run two jobs under the daemon, talk TLS to
  # S3 and encrypt; "arm64" builds the image natively (with its pytest gate)
  # and runs every suite that needs no MinIO (CS-MinIO is amd64-only).
  e2e:
    name: 🧪 E2E Round Trip (${{ matrix.leg }})
    runs-on: ${{ matrix.runner || 'ubuntu-latest' }}
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - leg: compose
          - leg: lts
            mariadb: 'mariadb:11.4'
            mysql: 'mysql:8.4'
          - leg: latest
            mariadb: 'mariadb:latest'
            mysql: 'mysql:latest'
          - leg: mariadb-11.8
            mariadb: 'mariadb:11.8'
          - leg: alerts
            suites: alerts
          - leg: multijob
            suites: multijob
          - leg: tls
            suites: tls
          - leg: encryption
            suites: encryption
          - leg: arm64
            runner: ubuntu-24.04-arm
            suites: engines alerts multijob encryption
            minio: '0'
    steps:
      - uses: actions/checkout@v7
      - name: Run the round trips
        env:
          E2E_SUITES: ${{ matrix.suites || 'engines' }}
          E2E_MARIADB_IMAGE: ${{ matrix.mariadb }}
          E2E_MYSQL_IMAGE: ${{ matrix.mysql }}
          E2E_MINIO: ${{ matrix.minio || '1' }}
        run: bash scripts/e2e.sh

  # ============================================
  # Release Job (only on main branch push)
  # ============================================

  release:
    name: 📦 Create Semantic Release
    needs: [validate-compose, validate-scripts, test, e2e]
    if: |
      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
      needs.validate-compose.result == 'success' &&
      needs.validate-scripts.result == 'success' &&
      needs.test.result == 'success' &&
      needs.e2e.result == 'success'
    uses: bauer-group/automation-templates/.github/workflows/modules-semantic-release.yml@main
    with:
      target-branch: 'main'
      dry-run: false
      force-release: ${{ inputs.force-release || false }}
    secrets: inherit

  # ============================================
  # Docker Build & Push (backuphelper — the central image)
  # ============================================

  docker-build-release:
    name: 🐳 Build & Push backuphelper
    needs: release
    if: needs.release.outputs.release-created == 'true'
    uses: bauer-group/automation-templates/.github/workflows/docker-build.yml@main
    with:
      deploy-environment: 'production'
      publish-to: 'ghcr'
      ghcr-image-name: 'bauer-group/CS-BackupHelper/backuphelper'
      docker-image-name: 'bauergroup/backuphelper'

      release-version: ${{ needs.release.outputs.version }}
      image-tags: 'stable'

      update-dockerfile-version: true
      auto-tags: true
      latest-tag: true

      dockerfile-path: './Dockerfile'
      docker-context: '.'
      platforms: 'linux/amd64,linux/arm64'

      push: true

      security-scan: false
      security-fail-on: 'CRITICAL'
      generate-sbom: true
      sync-dockerhub-readme: true
    secrets: inherit

  docker-build-pr:
    name: 🔨 Validate backuphelper Build (PR)
    needs: [validate-compose, validate-scripts, test]
    if: |
      github.event_name == 'pull_request' &&
      needs.validate-compose.result == 'success' &&
      needs.validate-scripts.result == 'success' &&
      needs.test.result == 'success'
    uses: bauer-group/automation-templates/.github/workflows/docker-build.yml@main
    with:
      publish-to: 'ghcr'
      ghcr-image-name: 'bauer-group/CS-BackupHelper/backuphelper'

      auto-tags: true
      dockerfile-path: './Dockerfile'
      docker-context: '.'
      platforms: 'linux/amd64'

      push: false

      security-scan: false
      security-fail-on: 'CRITICAL'
    secrets: inherit