app-builder.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: App Builder

on:
  workflow_call:
    inputs:
      app:
        type: string
        description: App Name
        required: true
      release:
        type: boolean
        description: Release
        required: true

jobs:
  plan:
    name: Plan
    runs-on: ubuntu-latest
    outputs:
      app-exists: ${{ steps.app-exists.outputs.exists }}
      platforms: ${{ steps.app-options.outputs.platforms }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
        with:
          persist-credentials: false

      - name: Check For Existing App
        uses: ./.github/actions/app-exists
        id: app-exists
        with:
          app: ${{ inputs.app }}

      - name: Check Dockerfile (COPY --chmod=0755 . /)
        if: ${{ steps.app-exists.outputs.exists == 'true' }}
        run: |-
          set -euo pipefail
          dockerfile="apps/${{ inputs.app }}/Dockerfile"
          if [[ ! -f "$dockerfile" ]]; then
            echo "::error file=${dockerfile}::Dockerfile not found"
            exit 1
          fi
          # Required by .github/instructions/dockerfile.instructions.md:
          # "MUST include `COPY --chmod=0755 . /` so container tests work."
          # Accept equivalent variants that still copy the whole app context to /:
          #   - mode 0755 or 0775 (with or without leading 0)
          #   - source `.` or `./`
          # Reject narrowed sources (e.g. `root/`, single files) which break
          # /container-test.yaml placement.
          if ! grep -Eq '^[[:space:]]*COPY[[:space:]]+--chmod=0?7[57]5[[:space:]]+\.\/?[[:space:]]+/[[:space:]]*$' "$dockerfile"; then
            echo "::error file=${dockerfile}::Missing required directive 'COPY --chmod=0755 . /' (or accepted variant copying the whole app context to /). See .github/instructions/dockerfile.instructions.md."
            exit 1
          fi

      - name: Get App Options
        uses: ./.github/actions/app-options
        id: app-options
        with:
          app: ${{ inputs.app }}

      - name: Get App Versions
        uses: ./.github/actions/app-versions
        id: app-versions
        with:
          upstream-version: ${{ steps.app-options.outputs.version }}

      - name: Build App Metadata
        uses: docker/metadata-action@deaa0dee567db6b95038c14152b037af85a8fe3b
        id: meta
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
        with:
          flavor: latest=false
          images: |
            ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}
            ghcr.io/containerforge/${{ inputs.app }}
            quay.io/containerforge/${{ inputs.app }}
            oci.trueforge.org/containerforge/${{ inputs.app }}
          tags: |
            type=semver,pattern={{version}},value=${{ steps.app-versions.outputs.semantic }},enable=${{ steps.app-versions.outputs.is-valid-semver && inputs.release }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.app-versions.outputs.semantic }},enable=${{ steps.app-versions.outputs.is-valid-semver && inputs.release }}
            type=semver,pattern={{major}},value=${{ steps.app-versions.outputs.semantic }},enable=${{ steps.app-versions.outputs.is-valid-semver && inputs.release }}
            type=raw,value=${{ steps.app-versions.outputs.raw }},enable=${{ steps.app-versions.outputs.is-valid-semver && inputs.release }}
            type=raw,value=rolling,enable=${{ inputs.release }}
            type=raw,value=sandbox,enable=${{ ! inputs.release }}
            type=raw,value=sha-${{ github.sha }},enable=${{ inputs.release }}

      - name: Upload Bake Metadata
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: ${{ inputs.app }}-bake-metadata
          path: ${{ steps.meta.outputs.bake-file }}
          if-no-files-found: error
          retention-days: 1

  build:
    name: Build (${{ matrix.platform }})
    needs: plan
    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJson(needs.plan.outputs.platforms) }}
    runs-on: ${{ startsWith(matrix.platform, 'linux/arm') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
        with:
          persist-credentials: false

      - name: Check if Build is allowed (Non Forked Repo)
        run: |
          # Default to push = true for main repo
          PUSH=true

          # If PR comes from a fork, disable push
          if [[ "${{ github.event_name }}" == "pull_request" ]] && \
             [[ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
            echo "Detected fork PR, disabling push"
            PUSH=false
          fi
          echo "PUSH=${PUSH}" >> $GITHUB_ENV

      - name: Get Target Architecture
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
        id: target
        with:
          script: |-
            core.setOutput('arch', '${{ matrix.platform }}'.split('/').pop());

      - name: Get App Options
        uses: ./.github/actions/app-options
        id: app-options
        with:
          app: ${{ inputs.app }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4a8376e001c7725687f0624d1c3698a3f6ab337e
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Download Bake Metadata
        uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317
        with:
          name: ${{ inputs.app }}-bake-metadata
          path: ${{ runner.temp }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@35d5669990ec77242c5a5926b41381a3f26fa947

      - name: Add Include Directory to Build Context
        run: |-
          rsync -a --progress ./include/ ./apps/${{ inputs.app }}/
          chmod +x ./apps/${{ inputs.app }}/healthcheck.sh

      - name: Build App
        uses: docker/bake-action@f1008e7fe95cd7b078b5b044b1d1402943fe06c1
        id: bake
        with:
          files: |
            ./docker-bake.hcl
            cwd://${{ runner.temp }}/docker-metadata-action-bake.json
          set: |
            *.args.VENDOR="TrueForge"
            *.cache-from=${{ format('type=registry,ref=ghcr.io/{0}/build_cache:{1}-{2},mode=max', github.repository_owner, inputs.app, steps.target.outputs.arch) }}
            *.cache-to=${{ inputs.release && format('type=registry,ref=ghcr.io/{0}/build_cache:{1}-{2},mode=max,compression=zstd,force-compression=true', github.repository_owner, inputs.app, steps.target.outputs.arch) || '' }}
            *.labels.org.opencontainers.image.title=${{ inputs.app }}
            *.labels.org.opencontainers.image.url=https://ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}
            *.labels.org.opencontainers.image.version=${{ steps.app-options.outputs.version }}
            *.labels.org.opencontainers.image.revision=${{ github.sha }}
            *.labels.org.opencontainers.image.vendor=TrueForge
            *.labels.org.opencontainers.image.authors=TrueForge <info@trueforge.org>
            *.labels.org.opencontainers.image.description=Container for ${{ inputs.app }} by TrueForge
            *.labels.wud.watch=true
            *.labels.wud.watch.digest=true
            *.labels.wud.tag.include=^\d+\.\d+\.\d+(?:\.\d+)?$
            *.labels.wud.compose.threshold=minor
            *.labels.wud.display.name=${{ inputs.app }}
            *.labels.wud.link.template=https://quay.io/repository/containerforge/${{ inputs.app }}?tab=tags
            *.labels.dd.watch=true
            *.labels.dd.watch.digest=true
            *.labels.dd.tag.include=^\d+\.\d+\.\d+(?:\.\d+)?$
            *.labels.dd.display.name=${{ inputs.app }}
            *.labels.dd.compose.threshold=minor
            *.labels.dd.link.template=https://quay.io/repository/containerforge/${{ inputs.app }}?tab=tags
            *.labels.com.centurylinklabs.watchtower.enable=true
            *.output=type=image,name=ghcr.io/${{ github.repository_owner }}/${{ inputs.app }},push=${{ env.PUSH }},push-by-digest=true,name-canonical=true,compression=zstd,force-compression=true
            *.platform=${{ matrix.platform }}
            *.tags=
          source: ./apps/${{ inputs.app }}
          targets: image

      - name: Export Digest
        run: |-
          mkdir -p ${{ runner.temp }}/digests
          DIGEST="${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
          echo "$DIGEST" > "${{ runner.temp }}/digests/${DIGEST#sha256:}"

      - name: Upload Digest
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: ${{ inputs.app }}-digests-${{ steps.target.outputs.arch }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1


  merge:
    name: Merge
    runs-on: ubuntu-latest
    needs: build
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
    outputs:
      digest: ${{ steps.digest.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
        with:
          persist-credentials: false

      - name: Download Bake Metadata
        uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317
        with:
          name: ${{ inputs.app }}-bake-metadata
          path: ${{ runner.temp }}

      - name: Download Digests
        uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317
        with:
          path: ${{ runner.temp }}/digests
          pattern: ${{ inputs.app }}-digests-*
          merge-multiple: true

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Login to Quay
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_CF_USER }}
          password: ${{ secrets.QUAY_CF_TOKEN }}

      - name: Create Multi-Arch Manifest List
        working-directory: ${{ runner.temp }}/digests
        run: |-
          # Get GHCR tags
          GHCR_TAGS=$(jq -r --compact-output '.target."docker-metadata-action".tags
            | map(select(startswith("ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}")) | "-t " + .)
            | join(" ")' ${{ runner.temp }}/docker-metadata-action-bake.json)
          # Get Quay tags
          QUAY_TAGS=$(jq -r --compact-output '.target."docker-metadata-action".tags
            | map(select(startswith("quay.io/containerforge/'"${{ inputs.app }}"'")) | "-t " + .)
            | join(" ")' ${{ runner.temp }}/docker-metadata-action-bake.json)

          # Combine all tags
          ALL_TAGS="$QUAY_TAGS $GHCR_TAGS"

          # Create multi-arch manifest for all targets
          docker buildx imagetools create \
            $ALL_TAGS \
            $(printf 'ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@sha256:%s ' *)
      - name: Inspect Image
        run: |-
          docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}:$(jq --raw-output '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/docker-metadata-action-bake.json)

      - name: Export Digest
        id: digest
        run: |-
          TAG=$(jq --raw-output '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/docker-metadata-action-bake.json)
          DIGEST=$(docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}:${TAG} --format '{{ json . }}' | jq --raw-output '.manifest.digest')
          echo "digest=${DIGEST}" >> $GITHUB_OUTPUT

      - name: Set Quay to Public
        if: ${{ inputs.release }}
        run: |
          curl -X POST -H "Content-Type: application/json" \
            -d '{"visibility": "public"}' \
            -H "Authorization: Bearer ${{ secrets.QUAY_CF_API_TOKEN }}" \
            "https://quay.io/api/v1/repository/containerforge/${{ inputs.app }}/changevisibility"

  attest:
    name: Attest
    if: ${{ inputs.release }}
    needs:
      - merge
    runs-on: ubuntu-latest
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Login to Quay
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_CF_USER }}
          password: ${{ secrets.QUAY_CF_TOKEN }}

      - name: Upload Dependency Snapshot to GHCR
        uses: anchore/sbom-action@f0d33c151c04af6fcbf4363834e838fcc7c87783
        with:
          dependency-snapshot: true
          image: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }}

      - name: Upload Dependency Snapshot to Quay
        uses: anchore/sbom-action@f0d33c151c04af6fcbf4363834e838fcc7c87783
        with:
          dependency-snapshot: true
          image: quay.io/containerforge/${{ inputs.app }}@${{ needs.merge.outputs.digest }}

      - name: Attestation for GHCR
        uses: actions/attest-build-provenance@10334b5f1e684784025c3fc0a277c88c19089275
        with:
          push-to-registry: true
          subject-name: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}
          subject-digest: ${{ needs.merge.outputs.digest }}

      - name: Attestation for Quay
        uses: actions/attest-build-provenance@10334b5f1e684784025c3fc0a277c88c19089275
        with:
          push-to-registry: true
          subject-name: quay.io/containerforge/${{ inputs.app }}
          subject-digest: ${{ needs.merge.outputs.digest }}
      # TODO: reenable with gh cli added
      # - name: Verify Attestation for GHCR
      #   env:
      #     GITHUB_TOKEN: ${{ github.token }}
      #   run: |-
      #     gh attestation verify --repo ${{ github.repository }} oci://ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }}

      ## TODO: fix
      # - name: Verify Attestation for QUAY
      #   env:
      #     GITHUB_TOKEN: ${{ github.token }}
      #   run: |-
      #     cosign verify-attestation --type slsaprovenance1 \
      #       --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
      #       --certificate-identity-regexp "^https://github.com/trueforge-org/containerforge/.github/workflows/app-builder.yaml@refs/heads/main" \
      #       quay.io/trueforge-org/${{ inputs.app }}@${{ needs.merge.outputs.digest }}

      ## TODO: check and/or fix
      # - name: Verify Attestation for TrueForge-OCI
      #   env:
      #     GITHUB_TOKEN: ${{ github.token }}
      #   run: |-
      #     cosign verify-attestation --type slsaprovenance1 \
      #       --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
      #       --certificate-identity-regexp "^https://github.com/trueforge-org/containerforge/.github/workflows/app-builder.yaml@refs/heads/main" \
      #       oci.trueforge.org/containeforge/${{ inputs.app }}@${{ needs.merge.outputs.digest }}
  sign:
    name: sign
    if: ${{ inputs.release }}
    needs:
      - merge
    runs-on:
      group: default
    steps:

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Login to Quay
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_CF_USER }}
          password: ${{ secrets.QUAY_CF_TOKEN }}

      - name: Sign the merged digest for GHCR
        if: github.event_name != 'pull_request'
        run: |
          cosign sign ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }} -y \
            -a "repo=${{ github.repository }}" \
            -a "workflow=${{ github.workflow }}" \
            -a "ref=${{ github.sha }}"

      - name: Sign the merged digest for Quay
        if: github.event_name != 'pull_request'
        run: |
          cosign sign quay.io/containerforge/${{ inputs.app }}@${{ needs.merge.outputs.digest }} -y \
            -a "repo=${{ github.repository }}" \
            -a "workflow=${{ github.workflow }}" \
            -a "ref=${{ github.sha }}"

      - name: Verify the signed digest on GHCR
        if: github.event_name != 'pull_request'
        run: |
          cosign verify ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }} \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --certificate-identity=https://github.com/trueforge-org/containerforge/.github/workflows/app-builder.yaml@refs/heads/main

      - name: Verify the signed digest on Quay
        if: github.event_name != 'pull_request'
        run: |
          cosign verify quay.io/containerforge/${{ inputs.app }}@${{ needs.merge.outputs.digest }} \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --certificate-identity=https://github.com/trueforge-org/containerforge/.github/workflows/app-builder.yaml@refs/heads/main

  test:
    if: ${{ ! inputs.release }}
    name: Test
    needs:
      - merge
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
        with:
          persist-credentials: false

      - name: Generate Token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3
        id: app-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: Get App Options
        uses: ./.github/actions/app-options
        id: app-options
        with:
          app: ${{ inputs.app }}

      - name: Run App Tests
        uses: ./.github/actions/app-tests
        with:
          app: ${{ inputs.app }}
          image: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }}
          version: ${{ steps.app-options.outputs.version }}
          token: ${{ github.token }}

      - name: Get App Size Diff
        uses: ./.github/actions/app-size-diff
        id: app-size-diff
        with:
          from-app: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}:rolling
          to-app: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}:sandbox

      - name: Post App Size Diff
        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0
        with:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          header: app-size-diff-${{ inputs.app }}
          message: |
            ${{ steps.app-size-diff.outputs.size-diff-markdown }}



  announce:
    if: ${{ inputs.release && needs.plan.outputs.app-exists != 'true' }}
    name: Announce
    needs:
      - plan
      - attest
      - sign
    runs-on:
      group: default
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Generate Token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: Get App Options
        uses: ./.github/actions/app-options
        id: app-options
        with:
          app: ${{ inputs.app }}

      - name: Get Release Tag
        uses: ./.github/actions/release-tag
        id: release
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Create Release
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
        with:
          body: |
            > [!NOTE]
            > A new app has been added.

            ## 📦 App

            **Name**: [${{ inputs.app }}](https://github.com/${{ github.repository }}/pkgs/container/${{ inputs.app }})
            **Source**: <${{ steps.app-options.outputs.source }}>
          tag: ${{ steps.release.outputs.tag }}
          token: ${{ steps.app-token.outputs.token }}

  notify:
    if: ${{ inputs.release && !cancelled() }}
    needs:
      - build
      - merge
    name: Notify
    runs-on:
      group: default
    steps:
      - if: ${{ contains(needs.*.result, 'failure') }}
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - if: ${{ contains(needs.*.result, 'failure') }}
        name: Get App Options
        uses: ./.github/actions/app-options
        id: app-options
        with:
          app: ${{ inputs.app }}

      - if: ${{ contains(needs.*.result, 'failure') }}
        name: Send Discord Webhook
        uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
        with:
          color: "0xFF0000"
          description: |
            App: `${{ inputs.app }}`
            Version: `${{ steps.app-options.outputs.version }}`
            [Rebuild](${{ github.server_url }}/${{ github.repository }}/actions/workflows/release.yaml)
          nodetail: true
          title: App build failed
          username: GitHub Actions
          url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          webhook: ${{ secrets.DISCORD_WEBHOOK }}