build.yaml

name: Build-Publish

on:
  # Trigger on tags like v1.0.0
  push:
    tags:
      - 'v*'
    # Trigger on PR merges to main
    branches:
      - main
  # Allow manual trigger
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write  # push images to ghcr.io

    strategy:
      matrix:
        image_config:
          # iptables init container — used by envoy-sidecar mode to
          # set up traffic redirection. Proxy-sidecar mode does not
          # need this (HTTP_PROXY env var routing replaces iptables).
          - name: proxy-init
            context: ./authbridge/proxy-init
            dockerfile: Dockerfile.init

          # AuthBridge envoy-sidecar combined image —
          # Envoy + authbridge-envoy (ext_proc) + spiffe-helper.
          # Spiffe-helper starts conditionally based on SPIRE_ENABLED.
          - name: authbridge-envoy
            context: ./authbridge
            dockerfile: cmd/authbridge-envoy/Dockerfile

          # AuthBridge proxy-sidecar combined image (default mode) —
          # authbridge-proxy (full plugin set, includes parsers) +
          # spiffe-helper. No Envoy, no gRPC. Spiffe-helper starts
          # conditionally based on SPIRE_ENABLED.
          - name: authbridge
            context: ./authbridge
            dockerfile: cmd/authbridge-proxy/Dockerfile

          # AuthBridge proxy-sidecar LITE image — the SAME authbridge-proxy
          # binary + Dockerfile, built with a trimmed plugin set (roughly
          # halving the binary). A build variant, not a separate binary.
          # GO_BUILD_TAGS is derived at step time from
          # authbridge/scripts/lite-tags rather than declared here, so
          # adding a plugin doesn't require editing this file.
          - name: authbridge-lite
            context: ./authbridge
            dockerfile: cmd/authbridge-proxy/Dockerfile

          # AuthBridge proxy-sidecar CPEX image — authbridge-proxy built
          # with -tags cpex (links libcpex_ffi.a from a pinned CPEX
          # release) so the `cpex` plugin routes hooks through the CPEX
          # framework (APL DSL + named CPEX policy plugins). Needs the
          # CPEX_FFI_VERSION build-arg, read from the CPEX_FFI_VERSION
          # file in the build step below.
          - name: authbridge-cpex
            context: ./authbridge
            dockerfile: cmd/authbridge-cpex/Dockerfile

          # SPARC reflection service — the backend the `sparc` plugin calls.
          # Deployed once per cluster via authbridge/sparc-service/deploy.
          - name: sparc-service
            context: ./authbridge/sparc-service
            dockerfile: Dockerfile

    steps:
      # 1. Checkout code
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      # 1b. Set up Go — needed by the buildargs step for authbridge-lite,
      # which derives GO_BUILD_TAGS from plugin source at build time.
      # Cheap to install for every matrix row (~1s of cache pull); no-op
      # for rows that don't need it.
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: authbridge/scripts/lite-tags/go.mod

      # 2. Set up QEMU for multi-arch builds
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4

      # 3. Set up Docker Buildx
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4

      # 4. Log in to GitHub Container Registry
      - name: Log in to ghcr.io
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # 5. Generate image tag
      - name: Generate image tag
        id: tag
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            echo "tag=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          else
            # Use branch name or 'manual' for workflow_dispatch
            BRANCH="${{ github.ref_name }}"
            # Sanitize branch name (replace / with -)
            BRANCH="${BRANCH//\//-}"
            echo "tag=${BRANCH}-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
          fi

      # 6. Extract Docker metadata
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6
        with:
          images: ghcr.io/${{ github.repository }}/${{ matrix.image_config.name }}
          tags: |
            # Always use the computed tag
            type=raw,value=${{ steps.tag.outputs.tag }}
            # Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}

      # 6b. Resolve per-image build-args.
      #   authbridge-cpex: CPEX_FFI_VERSION (release tag) and CPEX_FFI_ABI
      #     (integer the linked lib must report), read from the files
      #     next to its Dockerfile and asserted at build time.
      #   authbridge-lite: GO_BUILD_TAGS, derived from plugin source
      #     (authbridge/scripts/lite-tags) so the list stays in sync
      #     without hand-maintenance.
      #   Other images leave args empty (an undeclared build-arg is
      #   ignored).
      - name: Resolve build args
        id: buildargs
        run: |
          case "${{ matrix.image_config.name }}" in
            authbridge-cpex)
              VERSION="$(tr -d '[:space:]' < authbridge/cmd/authbridge-cpex/CPEX_FFI_VERSION)"
              ABI="$(tr -d '[:space:]' < authbridge/cmd/authbridge-cpex/CPEX_FFI_ABI)"
              {
                echo "args<<EOF"
                echo "CPEX_FFI_VERSION=${VERSION}"
                echo "CPEX_FFI_ABI=${ABI}"
                echo "EOF"
              } >> "$GITHUB_OUTPUT"
              ;;
            authbridge-lite)
              TAGS=$(go -C authbridge/scripts/lite-tags run .)
              {
                echo "args<<EOF"
                echo "GO_BUILD_TAGS=${TAGS}"
                echo "EOF"
              } >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "args=" >> "$GITHUB_OUTPUT"
              ;;
          esac

      # 7. Build and push image
      - name: Build and push ${{ matrix.image_config.name }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7
        with:
          context: ${{ matrix.image_config.context }}
          file: ${{ matrix.image_config.context }}/${{ matrix.image_config.dockerfile }}
          # Dynamically-resolved args from step 6b: authbridge-cpex
          # (CPEX_FFI_*) and authbridge-lite (GO_BUILD_TAGS from
          # scripts/lite-tags). Other images resolve to empty.
          build-args: |
            ${{ steps.buildargs.outputs.args }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}