ci.yml

name: ci

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

# A push to main is the only run that moves the shared runtime tag, so it must not
# be cancelled by the next merge: a cancelled run leaves the tag on the previous
# digest and nothing retries it until someone pushes again. Pull requests stay
# cancellable — they move no tag, so a superseded run is pure waste.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  ci:
    needs: image
    permissions:
      contents: read
    uses: codefly-dev/core/.github/workflows/go-service-ci.yml@f16e045805dbd213cdbebf98d5f7cbe802496d7c

  image:
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    # Pushes to main queue rather than cancel, so a hung registry read would stall
    # every later merge until GitHub's six-hour default rather than just itself.
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

      - name: Resolve runtime image
        id: runtime
        shell: bash
        run: |
          set -euo pipefail
          name=$(jq -er '.name' runtime-image.json)
          tag=$(jq -er '.tag' runtime-image.json)
          digest=$(jq -er '.digest' runtime-image.json)
          echo "name=$name" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "digest=$digest" >> "$GITHUB_OUTPUT"
          echo "reference=$name@$digest" >> "$GITHUB_OUTPUT"
          echo "tag_reference=$name:$tag" >> "$GITHUB_OUTPUT"

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          cache: false
          go-version-file: go.mod

      - name: Qualify standalone runtime library
        run: python3 scripts/qualify-runtime-library.py

      # Registered before the tests, not just before the multi-arch publish: the
      # bootstrap image build test verifies linux/arm64, which needs emulation on an
      # amd64 runner. Without this the arm64 case would skip and a wrong arm64
      # archive checksum would pass CI.
      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130

      - name: Run unit tests
        run: go test ./... -skip '^(TestCreateToRunDocker|TestDirtyMigrationFailsClosed|TestLifecycleContractDocker|TestMigrationLockBudgetExpiresWhilePeerHoldsTheLock|TestMigrationStatementBudgetExpiresAndPreservesTheLedger)$' -timeout 20m

      - name: Build runtime image
        run: docker build --build-arg SOURCE_DATE_EPOCH=0 --tag service-postgres:test .

      # Real-database regression for the dirty-migration fail-closed path
      # (codefly-dev/service-postgres#76). Runs against the image just built, so
      # it needs no registry access; SERVICE_POSTGRES_TEST_IMAGE also makes the
      # prerequisite mandatory, so a missing docker daemon fails instead of
      # silently skipping the regression.
      - name: Migration fail-closed regression
        env:
          SERVICE_POSTGRES_TEST_IMAGE: service-postgres:test
        run: go test . -run '^TestDirtyMigrationFailsClosed$' -timeout 20m

      # Real-database regression for the migration budgets
      # (codefly-dev/service-postgres#80). Both budgets are enforced by session
      # GUCs, so only a real backend holding a real lock and running a real long
      # statement can show that they bite. Same image and same mandatory
      # prerequisite as the step above.
      - name: Migration budget regression
        env:
          SERVICE_POSTGRES_TEST_IMAGE: service-postgres:test
        run: go test . -run '^(TestMigrationLockBudgetExpiresWhilePeerHoldsTheLock|TestMigrationStatementBudgetExpiresAndPreservesTheLedger)$' -timeout 20m

      - name: Smoke test runtime image
        shell: bash
        run: |
          set -euo pipefail

          cleanup() {
            docker rm -f service-postgres-root service-postgres-nonroot >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          smoke() {
            local container_name="$1"
            shift
            docker run --detach --name "$container_name" "$@" \
              --env POSTGRES_PASSWORD=test service-postgres:test >/dev/null

            local ready=false
            for _ in $(seq 1 60); do
              local state
              local ready_count
              state=$(docker inspect --format '{{.State.Status}}' "$container_name")
              ready_count=$(docker logs "$container_name" 2>&1 |
                grep -c 'database system is ready to accept connections' || true)
              if [[ "$ready_count" -ge 2 ]] &&
                docker exec "$container_name" pg_isready -U postgres >/dev/null 2>&1; then
                ready=true
                break
              fi
              if [[ "$state" != running ]]; then
                break
              fi
              sleep 1
            done

            if [[ "$ready" != true ]]; then
              docker logs "$container_name"
              return 1
            fi

            docker exec "$container_name" psql \
              -v ON_ERROR_STOP=1 -U postgres -d postgres \
              -c "CREATE EXTENSION vector" \
              -c "SELECT round(('[1,2,3]'::vector <-> '[4,5,6]'::vector)::numeric, 6)"
            docker rm -f "$container_name" >/dev/null
          }

          smoke service-postgres-root
          smoke service-postgres-nonroot \
            --user 70:70 \
            --read-only \
            --tmpfs /var/lib/postgresql/data:uid=70,gid=70 \
            --tmpfs /var/run/postgresql:uid=70,gid=70 \
            --tmpfs /tmp:uid=70,gid=70

      - name: Log in to GitHub Container Registry
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
        with:
          driver-opts: image=moby/buildkit@sha256:2f5adac4ecd194d9f8c10b7b5d7bceb5186853db1b26e5abd3a657af0b7e26ec

      - name: Publish runtime image candidate
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        id: candidate
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          build-args: SOURCE_DATE_EPOCH=0
          context: .
          outputs: type=image,name=${{ steps.runtime.outputs.name }},push-by-digest=true,name-canonical=true,push=true,rewrite-timestamp=true
          platforms: linux/amd64,linux/arm64
          provenance: false
          sbom: false

      - name: Verify runtime image candidate
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        env:
          ACTUAL_DIGEST: ${{ steps.candidate.outputs.digest }}
          EXPECTED_DIGEST: ${{ steps.runtime.outputs.digest }}
        run: |
          set -euo pipefail
          if [[ "$ACTUAL_DIGEST" != "$EXPECTED_DIGEST" ]]; then
            echo "built digest $ACTUAL_DIGEST does not match runtime-image.json $EXPECTED_DIGEST" >&2
            exit 1
          fi

      - name: Verify published runtime image
        env:
          RUNTIME_IMAGE: ${{ steps.runtime.outputs.reference }}
        run: |
          set -euo pipefail
          anonymous_docker_config=$(mktemp -d)
          trap 'rm -rf -- "$anonymous_docker_config"' EXIT
          manifest=$(docker --config "$anonymous_docker_config" manifest inspect "$RUNTIME_IMAGE")
          jq -e '
            [.manifests[].platform | "\(.os)/\(.architecture)"] | sort ==
            ["linux/amd64", "linux/arm64"]
          ' <<< "$manifest"
          docker --config "$anonymous_docker_config" pull "$RUNTIME_IMAGE"

      - name: Run runtime lifecycle tests
        run: go test . -run '^TestLifecycleContractDocker$' -count=1

      - name: Scan published runtime image
        env:
          RUNTIME_IMAGE: ${{ steps.runtime.outputs.reference }}
        run: |
          docker save --output /tmp/service-postgres-image.tar "$RUNTIME_IMAGE"
          mkdir -p /tmp/trivy-cache
          docker run --rm \
            --volume /tmp/trivy-cache:/root/.cache/trivy \
            --volume /tmp/service-postgres-image.tar:/image.tar:ro \
            aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f \
            image --quiet --format table --severity HIGH,CRITICAL \
            --exit-code 1 --input /image.tar

      # The tag string is read from runtime-image.json, so every branch resolves
      # the same one. A PR build that moved it would race every other PR on that
      # single tag, and would repoint what releases consume while still unmerged,
      # with nothing to move it back if the PR is closed. The candidate publish
      # above keeps the wider guard: it pushes by digest and moves no tag.
      #
      # Every step above gates this one, so a commit that relocks the digest and
      # then fails the scan leaves the tag on the older digest until a later push
      # to main goes green. That is the point — an image that fails a CRITICAL
      # scan must not become what a plain `docker pull` of the tag returns.
      - name: Tag verified runtime image
        if: github.event_name == 'push'
        env:
          EXPECTED_DIGEST: ${{ steps.runtime.outputs.digest }}
          RUNTIME_IMAGE: ${{ steps.runtime.outputs.reference }}
          RUNTIME_TAG: ${{ steps.runtime.outputs.tag_reference }}
        run: .github/scripts/tag-runtime-image.sh "$RUNTIME_TAG"

      # Image evidence for the digest this run verified, one CycloneDX document
      # per platform the lock declares, so the inventory a consumer retrieves
      # describes exactly the image it deploys.
      #
      # It runs after the tag move, unlike the scan above. The scan reads a
      # local `docker save` tar and needs no network, so gating the tag on it
      # costs nothing; producing evidence pulls every platform from the registry
      # again, and a transient registry failure there must not be what strands
      # the shared tag on the previous digest with nothing to retry it. A
      # failure here still fails the run — it just no longer decides what a
      # plain `docker pull` of the tag returns.
      - name: Inventory published runtime image
        env:
          RUNTIME_IMAGE: ${{ steps.runtime.outputs.reference }}
          RUNTIME_NAME: ${{ steps.runtime.outputs.name }}
        run: |
          set -euo pipefail
          mkdir -p /tmp/image-sbom
          manifest=$(docker buildx imagetools inspect "$RUNTIME_IMAGE" --format '{{json .Manifest}}')
          for platform in $(jq -er '.platforms[]' runtime-image.json); do
            # Variant is part of the platform identity: linux/arm/v6 and
            # linux/arm/v7 are one string apart, and selecting on os/arch alone
            # would match both and build a reference naming two digests.
            child=$(jq -er --arg platform "$platform" '
              [ .manifests[]
                | select(.platform.os + "/" + .platform.architecture
                    + (if .platform.variant then "/" + .platform.variant else "" end) == $platform)
                | .digest ]
              | if length == 1 then .[0]
                else error("expected exactly one manifest for \($platform), got \(length)") end' <<< "$manifest")
            document="/tmp/image-sbom/${platform//\//-}-${child#sha256:}.cdx.json"
            docker run --rm --network bridge --read-only --cap-drop ALL \
              --security-opt no-new-privileges --tmpfs /tmp:rw,noexec,nosuid --env HOME=/tmp \
              anchore/syft@sha256:b4f1df79f97b817682d8b5ff941eb6bfe74f6172553a5e312c75bbc2eabc405c \
              "registry:$RUNTIME_NAME@$child" -o cyclonedx-json@1.5 > "$document"
            jq -e '.metadata.component.name != null and (.components | length) > 0' "$document" >/dev/null
          done

      - name: Upload image SBOM evidence
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: image-sbom-${{ github.run_id }}-${{ github.run_attempt }}
          path: /tmp/image-sbom