ci.yml

name: CI

on:
  pull_request:
    branches:
      - develop
      - main
      - "release/**"
      - "rc/**"
  push:
    branches:
      - develop
      - main
      - "feature/**"
      - "release/**"
      - "rc/**"
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Format check
        run: npm run format:check

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm run test

      - name: Build
        run: npm run build

      - name: Audit dependencies (block on high and above)
        run: npm audit --audit-level=high

  dependency-review:
    name: dependency-review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Dependency review (block on high and above)
        uses: actions/dependency-review-action@v5
        with:
          fail-on-severity: high

  image-scan:
    name: image-scan
    runs-on: ubuntu-latest
    needs: validate
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build image for scanning
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          tags: benchfinity:scan
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan image (block on fixable high and critical)
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: benchfinity:scan
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          vuln-type: os,library
          exit-code: "1"
          format: table

  docker:
    name: docker
    runs-on: ubuntu-latest
    needs: [validate, image-scan]
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.meta.outputs.image }}
      tags: ${{ steps.meta.outputs.tags }}
      version: ${{ steps.meta.outputs.version }}
      release_tag: ${{ steps.meta.outputs.release_tag }}
      release_name: ${{ steps.meta.outputs.release_name }}
      deploy_tag: ${{ steps.meta.outputs.deploy_tag }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: 22

      - name: Compute image tags
        id: meta
        shell: bash
        run: |
          version="$(node -p "require('./package.json').version")"
          short_sha="${GITHUB_SHA::7}"
          image="ghcr.io/${GITHUB_REPOSITORY,,}"
          branch="${GITHUB_REF_NAME}"
          release_tag=""
          release_name=""
          deploy_tag=""
          prerelease="false"

          if [[ "${branch}" == "main" ]]; then
            # Publish an immutable :<version>-<sha> that production pins to,
            # so every release changes CD desired state and ArgoCD rolls it out.
            tags="${image}:${version}"$'\n'"${image}:${version}-${short_sha}"
            deploy_tag="${version}-${short_sha}"
            release_tag="v${version}"
            release_name="Benchfinity v${version}"
          elif [[ "${branch}" == "develop" ]]; then
            tags="${image}:${version}-SNAPSHOT.${short_sha}"$'\n'"${image}:develop"
          elif [[ "${branch}" == release/* || "${branch}" == rc/* ]]; then
            tags="${image}:${version}-rc.${short_sha}"
            release_tag="v${version}-rc.${short_sha}"
            release_name="Benchfinity v${version} RC ${short_sha}"
            prerelease="true"
          elif [[ "${branch}" == feature/* ]]; then
            safe_branch="$(printf '%s' "${branch#feature/}" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9_.-]+#-#g; s#-+#-#g; s#(^-|-$)##g')"
            tags="${image}:${version}-${safe_branch}-${short_sha}-SNAPSHOT"
          else
            safe_branch="$(printf '%s' "${branch}" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9_.-]+#-#g; s#-+#-#g; s#(^-|-$)##g')"
            tags="${image}:${version}-${safe_branch}-${short_sha}-SNAPSHOT"
          fi

          {
            echo "image=${image}"
            echo "version=${version}"
            echo "release_tag=${release_tag}"
            echo "release_name=${release_name}"
            echo "deploy_tag=${deploy_tag}"
            echo "prerelease=${prerelease}"
            echo "tags<<TAGS"
            printf '%s\n' "${tags}"
            echo "TAGS"
          } >> "${GITHUB_OUTPUT}"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            org.opencontainers.image.title=Benchfinity
            org.opencontainers.image.description=Gridfinity-compatible baseplate generator
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  release:
    name: release
    runs-on: ubuntu-latest
    needs: docker
    if: github.event_name == 'push' && needs.docker.outputs.release_tag != ''
    permissions:
      contents: write
    steps:
      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.docker.outputs.release_tag }}
          RELEASE_NAME: ${{ needs.docker.outputs.release_name }}
          PRERELEASE: ${{ needs.docker.outputs.prerelease }}
          IMAGE: ${{ needs.docker.outputs.image }}
          IMAGE_TAGS: ${{ needs.docker.outputs.tags }}
        shell: bash
        run: |
          if gh release view "${TAG}" -R "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            echo "Release ${TAG} already exists"
            exit 0
          fi

          body="$(printf 'Container image:\n\n%s\n\nCommit: %s\n' "${IMAGE_TAGS}" "${GITHUB_SHA}")"

          gh api -X POST "repos/${GITHUB_REPOSITORY}/releases" \
            -f tag_name="${TAG}" \
            -f target_commitish="${GITHUB_SHA}" \
            -f name="${RELEASE_NAME}" \
            -f body="${body}" \
            -F prerelease="${PRERELEASE}" \
            -F generate_release_notes=true

  helm:
    name: helm
    runs-on: ubuntu-latest
    needs: validate
    if: github.event_name == 'push'
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Helm
        uses: azure/setup-helm@v5

      - name: Lint chart
        run: helm lint deploy/helm/benchfinity

      - name: Template chart
        run: helm template benchfinity deploy/helm/benchfinity > /dev/null

      - name: Compute chart version
        id: chart
        shell: bash
        run: |
          base="$(awk '/^version:/ { print $2; exit }' deploy/helm/benchfinity/Chart.yaml)"
          short_sha="${GITHUB_SHA::7}"
          branch="${GITHUB_REF_NAME}"
          publish="false"
          if [[ "${branch}" == "main" || "${GITHUB_REF}" == refs/tags/* ]]; then
            version="${base}"
            publish="true"
          elif [[ "${branch}" == "develop" ]]; then
            version="${base}-SNAPSHOT.${short_sha}"
            publish="true"
          else
            version="${base}-${short_sha}"
          fi
          {
            echo "version=${version}"
            echo "publish=${publish}"
          } >> "${GITHUB_OUTPUT}"

      - name: Package and push chart to GHCR
        if: steps.chart.outputs.publish == 'true'
        shell: bash
        env:
          CHART_VERSION: ${{ steps.chart.outputs.version }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          helm package deploy/helm/benchfinity \
            --version "${CHART_VERSION}" \
            --app-version "${CHART_VERSION}"
          helm registry login ghcr.io -u "${REGISTRY_USER}" -p "${REGISTRY_TOKEN}"
          helm push "benchfinity-${CHART_VERSION}.tgz" oci://ghcr.io/benchfinity/charts

  deploy:
    name: deploy
    runs-on: ubuntu-latest
    needs: docker
    # Only production (main) auto-deploys, once the immutable image is published.
    # Bumps the pinned tag in Workbench-CD; ArgoCD (benchfinity-prod) reconciles
    # it onto k8s-prod. Uses the SSH deploy key, not GITHUB_TOKEN.
    if: github.event_name == 'push' && needs.docker.outputs.deploy_tag != ''
    permissions:
      contents: read
    steps:
      - name: Roll production by bumping Workbench-CD image tag
        env:
          DEPLOY_TAG: ${{ needs.docker.outputs.deploy_tag }}
          DEPLOY_KEY: ${{ secrets.WORKBENCH_CD_DEPLOY_KEY }}
          SOURCE_SHA: ${{ github.sha }}
          CD_REPO: BenchFinity/Workbench-CD
          CD_BRANCH: main
          OVERLAY: overlays/production/kustomization.yaml
          IMAGE_NAME: ghcr.io/benchfinity/workbench
        shell: bash
        run: |
          set -euo pipefail

          if [[ -z "${DEPLOY_KEY}" ]]; then
            echo "::error::WORKBENCH_CD_DEPLOY_KEY secret is not set; cannot push to ${CD_REPO}." \
                 "Add a write deploy key to ${CD_REPO} and store its private key as that secret."
            exit 1
          fi

          mkdir -p ~/.ssh
          printf '%s\n' "${DEPLOY_KEY}" > ~/.ssh/cd_deploy_key
          chmod 600 ~/.ssh/cd_deploy_key
          ssh-keyscan -t ed25519,rsa github.com >> ~/.ssh/known_hosts 2>/dev/null
          export GIT_SSH_COMMAND="ssh -i ~/.ssh/cd_deploy_key -o IdentitiesOnly=yes"

          git clone --depth 1 --branch "${CD_BRANCH}" "git@github.com:${CD_REPO}.git" cd-repo
          cd cd-repo

          # DEPLOY_TAG and IMAGE_NAME are CI-derived (package.json version + commit
          # SHA), not user-controlled input, so they are safe to pass to yq via env.
          DEPLOY_TAG="${DEPLOY_TAG}" IMAGE_NAME="${IMAGE_NAME}" yq -i \
            '(.images[] | select(.name == strenv(IMAGE_NAME)) | .newTag) = strenv(DEPLOY_TAG)' \
            "${OVERLAY}"

          if git diff --quiet -- "${OVERLAY}"; then
            echo "Production already pinned to ${DEPLOY_TAG}; nothing to deploy."
            exit 0
          fi

          git config user.name "benchfinity-workbench-ci[bot]"
          git config user.email "ci@benchfinity.com"
          git add "${OVERLAY}"
          git commit -m "deploy(workbench): roll production to ${DEPLOY_TAG}" \
                     -m "Auto-bumped by Workbench CI from BenchFinity/Workbench@${SOURCE_SHA}. ArgoCD reconciles."
          git push origin "HEAD:${CD_BRANCH}"
          echo "Pushed ${DEPLOY_TAG} to ${CD_REPO}@${CD_BRANCH}; ArgoCD will roll it out."