deploy-server.yml

name: Deploy Server Image

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "GHCR image tag to publish, for example v1.2.0"
        required: true
        type: string
  push:
    tags:
      - "v*"

permissions:
  contents: read
  packages: write

concurrency:
  group: ${{ github.workflow }}-${{ inputs.image_tag || github.ref_name }}
  cancel-in-progress: true

jobs:
  build-and-push:
    name: Build and push GHCR image
    if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    environment:
      name: production
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.image_tag || github.ref }}
          fetch-depth: 0

      - name: Resolve and verify release tag
        id: image
        env:
          DISPATCH_IMAGE_TAG: ${{ inputs.image_tag || '' }}
        run: |
          image_name="ghcr.io/${GITHUB_REPOSITORY,,}/readmates-server"
          release_tag="${DISPATCH_IMAGE_TAG:-${GITHUB_REF_NAME}}"
          if [[ ! "$release_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid release tag: $release_tag" >&2
            exit 1
          fi

          if [[ "$(git cat-file -t "$release_tag" 2>/dev/null || true)" != "tag" ]]; then
            echo "Release tag must be annotated: $release_tag" >&2
            exit 1
          fi

          tag_commit="$(git rev-list -n 1 "$release_tag")"
          head_commit="$(git rev-parse HEAD)"
          if [[ "$tag_commit" != "$head_commit" ]]; then
            echo "Checked out commit does not match release tag: $release_tag" >&2
            exit 1
          fi

          echo "name=$image_name" >> "$GITHUB_OUTPUT"
          echo "tag=$release_tag" >> "$GITHUB_OUTPUT"

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: 25

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Server quality gate and build jar
        run: ./server/gradlew -p server clean check bootJar

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
        with:
          platforms: arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Log in to GHCR
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push scan candidate
        id: build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: server
          file: server/Dockerfile.release
          platforms: linux/arm64
          push: true
          tags: ${{ steps.image.outputs.name }}:scan-${{ github.run_id }}-${{ github.run_attempt }}
          sbom: true
          provenance: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan image vulnerabilities
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        env:
          TRIVY_PLATFORM: linux/arm64
        with:
          image-ref: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}
          scanners: vuln
          format: table
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          exit-code: '1'

      - name: Promote scanned digest to release tag
        run: |
          docker buildx imagetools create \
            --tag "${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}" \
            "${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }}"

      - name: Record promoted digest
        run: |
          {
            echo "image=${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}"
            echo "digest=${{ steps.build.outputs.digest }}"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload server failure diagnostics
        if: ${{ failure() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: deploy-server-failure-diagnostics
          path: |
            server/build/reports/tests
            server/build/test-results
          if-no-files-found: ignore