build-deploy.yml

# Build each port, push it by digest, tag it on GHCR, copy it to Docker Hub.
#
#   plan     the version, the targets and the ports to build (scripts/plan-build)
#   gate     tests/run.sh static; the publish waits for it
#   build    one leg for each planned port, named "Build <arch>": inputs,
#            builder, build and push by digest (scripts/build-port),
#            evidence, image suite, digest record
#   publish  tags on GHCR only (scripts/publish-ghcr)
#   hub      copies GHCR tags to Docker Hub (scripts/sync-hub)
#   report   raises or clears the issues build-<arch>, publish-ghcr, publish-hub
#   status   starts status.yml
#   watch    checks the schedules, starts an overdue workflow
#
# ⭐ A port builds when the target has no <first alias>-v<date> tag for today.
# The second schedule builds only the ports that did not publish in the first.
# A port that fails its leg keeps its last image in latest.
#
# A dry run pushes to the scratch images (<image>-ci) and raises no issue.
# dry_run_hub copies to the Docker Hub scratch image too; it needs dry_run.
# ⭐ The run name of a dry run ends in "(dry run)". scripts/status-collect
# leaves such a run out of the build counts.
name: Build and publish
run-name: ${{ inputs.dry_run && 'Build and publish (dry run)' || 'Build and publish' }}

on:
  schedule:
    - cron: "30 5 * * *"
    - cron: "30 17 * * *"
  workflow_dispatch:
    inputs:
      arches:
        description: Ports to build, space separated; empty for every port
        type: string
        default: ""
      force:
        description: Build a port even when its dated tag for today exists
        type: boolean
        default: false
      dry_run:
        description: Push to the scratch images and raise no issue
        type: boolean
        default: false
      dry_run_hub:
        description: With dry_run, also copy to the Docker Hub scratch image
        type: boolean
        default: false
      allow_anchor_downgrade:
        description: Ports whose anchor may go below the published floor (none, all, or port names)
        type: string
        default: none

permissions: {}

# ⛔ A run in progress is never cancelled: a publish stopped half way leaves
# tags moved and the index not.
# ⚠ GitHub keeps one pending run in a group: a newer run replaces it. A dry
# run has its own group, so it never replaces a pending real run.
concurrency:
  group: build-deploy-${{ github.ref }}${{ inputs.dry_run && '-dry' || '' }}
  cancel-in-progress: false

defaults:
  run:
    shell: bash

env:
  GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/archlinux
  HUB_IMAGE: docker.io/pkgforge/archlinux

jobs:
  plan:
    name: Plan
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      packages: read
    outputs:
      version: ${{ steps.plan.outputs.version }}
      build_date: ${{ steps.plan.outputs.build_date }}
      target_image: ${{ steps.plan.outputs.target_image }}
      hub_target: ${{ steps.plan.outputs.hub_target }}
      carry_image: ${{ steps.plan.outputs.carry_image }}
      hub_image: ${{ steps.plan.outputs.hub_image }}
      publish_hub: ${{ steps.plan.outputs.publish_hub }}
      arches: ${{ steps.plan.outputs.arches }}
      matrix: ${{ steps.plan.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Plan
        id: plan
        env:
          DRY_RUN: ${{ inputs.dry_run }}
          DRY_RUN_HUB: ${{ inputs.dry_run_hub }}
          ARCHES: ${{ inputs.arches }}
          FORCE: ${{ inputs.force }}
          REG_USER_ghcr_io: ${{ github.actor }}
          REG_PASS_ghcr_io: ${{ github.token }}
        run: scripts/plan-build >> "$GITHUB_OUTPUT"

  gate:
    name: Static suite
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Restore the tools
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ runner.temp }}/tools
          key: tools-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/install-tools') }}

      # Without the tools the suite still runs, and a test that needs a
      # missing tool skips. CI has checked the same commit with every tool.
      - name: Install the tools
        id: tools
        run: |
          rc=0
          scripts/install-tools "$RUNNER_TEMP/tools" || rc=$?
          if [ "$rc" -eq 0 ]; then
            echo "$RUNNER_TEMP/tools" >> "$GITHUB_PATH"
            echo "require=1" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::scripts/install-tools exited $rc; the static suite runs with the tools of the runner"
            echo "require=0" >> "$GITHUB_OUTPUT"
          fi

      - name: Static suite
        env:
          TESTS_REQUIRE_TOOLS: ${{ steps.tools.outputs.require }}
        run: tests/run.sh -j 4 static

  # ⛔ No secret in a build leg: the package scripts of the port run here.
  # The GHCR login uses the job token, which can push packages only.
  build:
    name: Build ${{ matrix.arch }}
    needs: plan
    if: ${{ needs.plan.outputs.matrix != '[]' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 75
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.plan.outputs.matrix) }}
    env:
      ARCH: ${{ matrix.arch }}
      PLATFORM: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Register the emulator
        run: scripts/binfmt-register "$ARCH"

      - name: Pick the base image registry
        id: base
        run: |
          ref="$(scripts/pick-base-image)"
          echo "base_image=$ref" >> "$GITHUB_OUTPUT"

      # The committed lists stay when generation fails. The digest record
      # says which lists the build used.
      - name: Generate the mirror lists
        id: mirrors
        run: |
          rc=0
          scripts/gen-mirrorlist "$ARCH" || rc=$?
          case "$rc" in
            0) echo "mirrorlist=generated" >> "$GITHUB_OUTPUT" ;;
            3)
              echo "::notice::the committed mirror lists of $ARCH stay"
              echo "mirrorlist=committed" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "::warning::scripts/gen-mirrorlist $ARCH exited $rc; the committed mirror lists stay"
              echo "mirrorlist=committed" >> "$GITHUB_OUTPUT"
              ;;
          esac

      - name: Pick the transport
        id: transport
        run: |
          rc=0
          transport="$(scripts/pick-transport "$ARCH")" || rc=$?
          if [ "$rc" -ne 0 ] || [ -z "$transport" ]; then
            echo "::warning::scripts/pick-transport $ARCH exited $rc; the build reads through the Worker"
            transport=worker
          fi
          echo "transport=$transport" >> "$GITHUB_OUTPUT"

      # Each "drop LIST SERVER" line becomes a LIST=SERVER pair of SKIP_SERVERS.
      - name: Check the mirror lag
        id: lag
        env:
          TRANSPORT: ${{ steps.transport.outputs.transport }}
        run: |
          rc=0
          scripts/check-mirror-lag "$ARCH" > "$RUNNER_TEMP/lag.txt" || rc=$?
          cat "$RUNNER_TEMP/lag.txt"
          skip=""
          if [ "$rc" -eq 0 ]; then
            skip="$(awk '$1 == "drop" && NF >= 3 { printf "%s%s=%s", sep, $2, $3; sep = " " }' "$RUNNER_TEMP/lag.txt")"
          else
            echo "::warning::scripts/check-mirror-lag $ARCH exited $rc; the build reads each list as it is"
          fi
          echo "skip_servers=$skip" >> "$GITHUB_OUTPUT"

      # ⛔ A port that no server answers for fails here: a red leg, never a
      # green skip.
      - name: Resolve the anchor
        id: anchor
        env:
          TRANSPORT: ${{ steps.transport.outputs.transport }}
          SKIP_SERVERS: ${{ steps.lag.outputs.skip_servers }}
        run: |
          anchor="$(scripts/resolve-anchor "$ARCH")"
          echo "anchor=$anchor" >> "$GITHUB_OUTPUT"

      - name: Check the anchor floor
        env:
          ANCHOR: ${{ steps.anchor.outputs.anchor }}
          TRANSPORT: ${{ steps.transport.outputs.transport }}
          SKIP_SERVERS: ${{ steps.lag.outputs.skip_servers }}
          FLOOR_IMAGE: ${{ needs.plan.outputs.carry_image }}
          FLOOR_HUB_IMAGE: ${{ needs.plan.outputs.hub_image }}
          ALLOW_ANCHOR_DOWNGRADE: ${{ inputs.allow_anchor_downgrade || 'none' }}
        run: scripts/check-anchor-floor "$ARCH" "$ANCHOR"

      # The builder runs this image. A Docker Hub fault takes the same digest
      # from a mirror. So does a pull limit that runs out after the pick.
      - name: Set up the builder
        id: buildkit
        env:
          # tag: buildx-stable-1
          BUILDKIT_IMAGE: docker.io/moby/buildkit:buildx-stable-1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea
        run: scripts/build-port builder

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      # No tag here. The digest goes to the publish job after every test below.
      # A pull limit that runs out after the pick builds once more from the
      # next registry, and base_image names the registry that the build used.
      # ⚠ A run: step gets no ACTIONS_RUNTIME_TOKEN, and the gha cache needs
      # it. github-script starts the script with the environment of an action.
      - name: Build and push by digest
        id: push
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          TARGET_IMAGE: ${{ needs.plan.outputs.target_image }}
          BASE_IMAGE: ${{ steps.base.outputs.base_image }}
          IMAGE_VERSION: ${{ needs.plan.outputs.version }}
          SOURCE_COMMIT: ${{ github.sha }}
          BUILD_DATE: ${{ needs.plan.outputs.build_date }}
          TRANSPORT: ${{ steps.transport.outputs.transport }}
          SKIP_SERVERS: ${{ steps.lag.outputs.skip_servers }}
        with:
          script: await exec.exec('scripts/build-port', ['push'])

      # The databases that the build used, from the bootstrap stage in the
      # builder. The build args are those of the step above, so the stage is
      # the same one.
      - name: Export the databases that the build used
        id: snapshot
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          DB_SNAPSHOT: ${{ runner.temp }}/dbsnapshot
          BASE_IMAGE: ${{ steps.push.outputs.base_image }}
          IMAGE_VERSION: ${{ needs.plan.outputs.version }}
          SOURCE_COMMIT: ${{ github.sha }}
          BUILD_DATE: ${{ needs.plan.outputs.build_date }}
          TRANSPORT: ${{ steps.transport.outputs.transport }}
          SKIP_SERVERS: ${{ steps.lag.outputs.skip_servers }}
        with:
          script: await exec.exec('scripts/build-port', ['snapshot'])

      # --platform: the pushed index has an attestation manifest next to the
      # image, so a pull with no platform picks the platform of the runner.
      - name: Pull the image
        env:
          IMAGE: ${{ needs.plan.outputs.target_image }}@${{ steps.push.outputs.digest }}
        run: timeout -k 5 900 docker pull --platform "$PLATFORM" "$IMAGE"

      # ⛔ EXPECT_ANCHOR: the image must have the anchor that names its tag.
      - name: Write the evidence
        env:
          IMAGE: ${{ needs.plan.outputs.target_image }}@${{ steps.push.outputs.digest }}
          CONTAINER_RUNTIME: docker
          SOURCE_COMMIT: ${{ github.sha }}
          BUILD_DATE: ${{ needs.plan.outputs.build_date }}
          DB_SNAPSHOT: ${{ runner.temp }}/dbsnapshot
          EXPECT_ANCHOR: ${{ steps.anchor.outputs.anchor }}
        run: |
          mkdir -p "$RUNNER_TEMP/evidence"
          scripts/gen-evidence "$ARCH" "$IMAGE" "$PLATFORM" "$RUNNER_TEMP/evidence/rootfs-$ARCH.json"

      - name: Test the image
        env:
          IMAGE: ${{ needs.plan.outputs.target_image }}@${{ steps.push.outputs.digest }}
          CONTAINER_RUNTIME: docker
          EVIDENCE: ${{ runner.temp }}/evidence/rootfs-${{ matrix.arch }}.json
        run: tests/run.sh image

      - name: Upload the evidence
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: evidence-${{ matrix.arch }}
          path: ${{ runner.temp }}/evidence/rootfs-${{ matrix.arch }}.json
          if-no-files-found: error
          retention-days: 90
          overwrite: true

      # ⛔ Last, after every test: the publish tags only a digest it receives.
      - name: Write the digest record
        env:
          DIGEST: ${{ steps.push.outputs.digest }}
          ANCHOR: ${{ steps.anchor.outputs.anchor }}
          TRANSPORT: ${{ steps.transport.outputs.transport }}
          SKIP_SERVERS: ${{ steps.lag.outputs.skip_servers }}
          BASE_IMAGE: ${{ steps.push.outputs.base_image }}
          MIRRORLIST: ${{ steps.mirrors.outputs.mirrorlist }}
          BUILT_AT: ${{ needs.plan.outputs.build_date }}
        run: |
          mkdir -p "$RUNNER_TEMP/digest"
          jq -n --arg arch "$ARCH" --arg platform "$PLATFORM" --arg digest "$DIGEST" \
            --arg anchor "$ANCHOR" --arg transport "$TRANSPORT" --arg skip "$SKIP_SERVERS" \
            --arg base "$BASE_IMAGE" --arg mirrorlist "$MIRRORLIST" --arg built "$BUILT_AT" \
            '{arch: $arch, platform: $platform, digest: $digest, anchor: $anchor,
              transport: $transport, skip_servers: $skip, base_image: $base,
              mirrorlist: $mirrorlist, built_at: $built}' > "$RUNNER_TEMP/digest/digest-$ARCH.json"
          cat "$RUNNER_TEMP/digest/digest-$ARCH.json"

      - name: Upload the digest record
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: digest-${{ matrix.arch }}
          path: ${{ runner.temp }}/digest/digest-${{ matrix.arch }}.json
          if-no-files-found: error
          retention-days: 7
          overwrite: true

  # GHCR only. Docker Hub is the hub job, so a Docker Hub fault never stops
  # GHCR. It runs on a stand-down too: publish-ghcr then makes latest again
  # when latest does not hold the image of each first alias.
  publish:
    name: Publish to GHCR
    needs: [plan, build, gate]
    if: ${{ !cancelled() && needs.plan.result == 'success' && needs.gate.result == 'success' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    concurrency:
      group: publish-${{ needs.plan.outputs.target_image }}
      cancel-in-progress: false
    outputs:
      published: ${{ steps.publish.outputs.published }}
      carried: ${{ steps.publish.outputs.carried }}
      absent: ${{ steps.publish.outputs.absent }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Download the digest records
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: ${{ runner.temp }}/digests
          pattern: digest-*
          merge-multiple: true

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Tag on GHCR
        id: publish
        env:
          TARGET_IMAGE: ${{ needs.plan.outputs.target_image }}
          CARRY_IMAGE: ${{ needs.plan.outputs.carry_image }}
          HUB_IMAGE: ${{ needs.plan.outputs.hub_image }}
          VERSION: ${{ needs.plan.outputs.version }}
          REG_USER_ghcr_io: ${{ github.actor }}
          REG_PASS_ghcr_io: ${{ github.token }}
        run: |
          mkdir -p "$RUNNER_TEMP/digests"
          scripts/publish-ghcr "$RUNNER_TEMP/digests"

  # Also after a run that stands down, so a copy that an earlier run missed
  # is made the same day.
  hub:
    name: Copy to Docker Hub
    needs: [plan, publish]
    if: ${{ !cancelled() && needs.plan.outputs.publish_hub == 'true' && needs.publish.result == 'success' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: read
      packages: read
    concurrency:
      group: hub-${{ needs.plan.outputs.hub_target }}
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Copy the missing tags
        env:
          SOURCE_IMAGE: ${{ needs.plan.outputs.target_image }}
          HUB_TARGET: ${{ needs.plan.outputs.hub_target }}
          REG_USER_ghcr_io: ${{ github.actor }}
          REG_PASS_ghcr_io: ${{ github.token }}
          REG_USER_docker_io: ${{ secrets.DOCKERHUB_USERNAME }}
          REG_PASS_docker_io: ${{ secrets.DOCKERHUB_TOKEN }}
        run: scripts/sync-hub

  report:
    name: Report
    needs: [plan, gate, build, publish, hub]
    if: ${{ always() && inputs.dry_run != true }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      actions: read
      issues: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Raise or clear the issues
        env:
          GH_TOKEN: ${{ github.token }}
          ARCHES: ${{ needs.plan.outputs.arches }}
          PLAN_RESULT: ${{ needs.plan.result }}
          GATE_RESULT: ${{ needs.gate.result }}
          PUBLISH_RESULT: ${{ needs.publish.result }}
          HUB_RESULT: ${{ needs.hub.result }}
          PUBLISHED: ${{ needs.publish.outputs.published }}
          CARRIED: ${{ needs.publish.outputs.carried }}
          ABSENT: ${{ needs.publish.outputs.absent }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: scripts/report-build

  status:
    name: Start the status site
    needs: report
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      actions: write
    steps:
      - name: Start status.yml
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        # When the event does not name the default branch, the API names it.
        run: |
          branch="${DEFAULT_BRANCH:-}"
          if [ -z "$branch" ]; then
            branch="$(timeout -k 5 60 gh api "repos/$GH_REPO" --jq .default_branch)"
          fi
          timeout -k 5 60 gh workflow run status.yml --ref "$branch"

  watch:
    name: Watch the schedules
    if: ${{ inputs.dry_run != true }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      actions: write
      issues: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # Exit 3 is a stopped schedule, and schedules-stopped names it. The run
      # stays green: a red run counts as a failure of this workflow.
      - name: Check every schedule
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          rc=0
          scripts/watch-schedules || rc=$?
          case "$rc" in
            0) ;;
            3) echo "::warning::a schedule stopped; the issue schedules-stopped names it" ;;
            *) exit "$rc" ;;
          esac

      # Each scheduled workflow starts the others when theirs did not fire.
      - name: Start an overdue workflow
        if: ${{ always() }}
        env:
          GH_TOKEN: ${{ github.token }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          rc=0
          scripts/dispatch-overdue watchdog.yml 1560 || rc=$?
          scripts/dispatch-overdue status.yml 180 || rc=$?
          exit "$rc"