docker.yml

name: Docker

# Builds and validates all Docker images and the Compose application. CI calls it
# in dry-run mode. Release runs stage the images before publishing their final
# tags. Manually dispatched publish runs stage and publish in one call.

on:
  workflow_call:
    inputs:
      mode:
        description: "Mode: dry-run, stage, publish, or promote"
        required: false
        type: string
        default: dry-run
      ref:
        description: "Full Git commit SHA, tag name, or branch name to build"
        required: true
        type: string
      created:
        description: "OCI image creation timestamp; generated when omitted"
        required: false
        type: string
        default: ""
      staged_tag:
        description: "Immutable tag produced by a prior stage run"
        required: false
        type: string
        default: ""
    outputs:
      immutable_tag:
        description: "Immutable tag for the staged image bundle"
        value: ${{ jobs.preflight.outputs.immutable_tag }}
  workflow_dispatch:
    inputs:
      mode:
        description: "Validate only, or validate and publish"
        required: true
        type: choice
        default: dry-run
        options:
          - dry-run
          - publish
      ref:
        description: "Full Git commit SHA, tag name, or branch name to publish"
        required: true
        type: string

concurrency:
  group: "${{ github.workflow }} @ docker @ ${{ inputs.mode == 'publish' && inputs.ref || github.sha }}"
  cancel-in-progress: false

permissions:
  contents: read

env:
  # Skip the optional build-history export after Bake finishes.
  DOCKER_BUILD_SUMMARY: "false"
  REGISTRY: ghcr.io
  REGISTRY_PREFIX: ghcr.io/0xmiden

jobs:
  preflight:
    name: Validate Docker inputs
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      commit: ${{ steps.metadata.outputs.commit }}
      created: ${{ steps.metadata.outputs.created }}
      images: ${{ steps.images.outputs.images }}
      immutable_tag: ${{ steps.metadata.outputs.immutable_tag }}
      mode: ${{ steps.inputs.outputs.mode }}
      tag: ${{ steps.metadata.outputs.tag }}
    steps:
      - name: Validate inputs
        id: inputs
        env:
          INPUT_MODE: ${{ inputs.mode }}
          INPUT_REF: ${{ inputs.ref }}
          REPOSITORY_OWNER: ${{ github.repository_owner }}
          STAGED_TAG: ${{ inputs.staged_tag }}
        run: |
          set -euo pipefail

          mode="${INPUT_MODE}"
          if [[ -z "${INPUT_REF}" ]]; then
            echo "::error::A Git commit, tag, or branch is required"
            exit 1
          fi

          case "${mode}" in
            dry-run | stage | publish | promote) ;;
            *)
              echo "::error::Unsupported Docker mode: ${mode}"
              exit 1
              ;;
          esac

          if [[ "${mode}" != "dry-run" && "${REPOSITORY_OWNER}" != "0xMiden" ]]; then
            echo "::error::Docker publication is restricted to the 0xMiden repository"
            exit 1
          fi

          if [[ "${mode}" == "promote" && -z "${STAGED_TAG}" ]]; then
            echo "::error::Promote mode requires the immutable tag from a stage run"
            exit 1
          fi

          echo "mode=${mode}" >> "${GITHUB_OUTPUT}"

      - name: Define image matrix
        id: images
        run: |
          images="$(
            jq -cn '
              [
                "node",
                "validator",
                "ntx-builder",
                "remote-prover",
                "network-monitor",
                "funding-service",
                "node-tps-benchmark",
                "usdcx-genesis",
                "note-transport"
              ]
            '
          )"
          echo "images=${images}" >> "${GITHUB_OUTPUT}"

      - name: Checkout repository
        id: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve ref and prepare metadata
        id: metadata
        env:
          CHECKED_OUT_COMMIT: ${{ steps.checkout.outputs.commit }}
          CREATED: ${{ inputs.created }}
          INPUT_REF: ${{ inputs.ref }}
          STAGED_TAG: ${{ inputs.staged_tag }}
        run: |
          set -euo pipefail

          actual_commit="${CHECKED_OUT_COMMIT}"
          current_branch="$(git branch --show-current)"
          ref="${INPUT_REF}"

          if [[ "${ref}" == "${actual_commit}" ]]; then
            ref_type=commit
            ref_name="sha-${actual_commit:0:12}"
          elif [[ -n "${current_branch}" && "${ref}" == "${current_branch}" ]]; then
            ref_type=branch
            ref_name="${ref}"
          elif git show-ref --verify --quiet "refs/tags/${ref}" &&
            [[ "$(git rev-parse "refs/tags/${ref}^{commit}")" == "${actual_commit}" ]]; then
            ref_type=tag
            ref_name="${ref}"
          else
            echo "::error::Input ${ref} does not match the checked-out commit, branch, or tag"
            exit 1
          fi

          if [[ "${ref_type}" != "commit" && ! "${ref_name}" =~ ^[0-9A-Za-z_][0-9A-Za-z_.-]{0,127}$ ]]; then
            echo "::error::Git ${ref_type} ${ref_name} is not a valid container tag"
            exit 1
          fi

          if [[ "${ref_type}" != "commit" && ( "${ref_name}" == "latest" || "${ref_name}" == sha-* ) ]]; then
            echo "::error::The latest and sha-* tag namespaces are reserved"
            exit 1
          fi

          created="${CREATED}"
          if [[ -z "${created}" ]]; then
            created="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          fi

          immutable_tag="${STAGED_TAG}"
          if [[ -z "${immutable_tag}" ]]; then
            immutable_tag="sha-${actual_commit:0:12}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          elif [[ ! "${immutable_tag}" =~ ^sha-${actual_commit:0:12}-[0-9]+-[0-9]+$ ]]; then
            echo "::error::Invalid staged image tag: ${immutable_tag}"
            exit 1
          fi

          {
            echo "commit=${actual_commit}"
            echo "created=${created}"
            echo "immutable_tag=${immutable_tag}"
            echo "tag=${ref_name}"
          } >> "${GITHUB_OUTPUT}"

  validate-images:
    name: Validate Docker images (${{ matrix.platform }})
    needs: preflight
    if: ${{ needs.preflight.outputs.mode == 'dry-run' }}
    runs-on: warp-ubuntu-latest-x64-8x
    concurrency:
      group: docker-build-${{ vars.WARPBUILD_DOCKER_BUILDER_PROFILE }}-${{ matrix.architecture }}
      cancel-in-progress: false
      queue: max
    permissions:
      contents: read
      # WarpBuild uses OIDC to authenticate its remote builder.
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            architecture: amd64
          - platform: linux/arm64
            architecture: arm64
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.preflight.outputs.commit }}
          persist-credentials: false

      - name: Validate Docker images
        uses: WarpBuilds/bake-action@cb88c8ea0c887c0d1a3dcb534e71bd68a015e2d6 # v6.7.7
        with:
          source: .
          files: ./docker-bake.hcl
          targets: validate
          push: false
          profile-name: ${{ vars.WARPBUILD_DOCKER_BUILDER_PROFILE }}
          pull: true
          set: |
            *.platform=${{ matrix.platform }}
            *.args.CREATED=${{ needs.preflight.outputs.created }}
            *.args.VERSION=${{ needs.preflight.outputs.tag }}
            *.args.COMMIT=${{ needs.preflight.outputs.commit }}

      - name: Upload Kache cache report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: kache-report-${{ matrix.architecture }}
          path: kache-report/kache-report.md
          if-no-files-found: error
          retention-days: 1

  stage-images:
    name: Stage Docker images (${{ matrix.platform }})
    needs: preflight
    if: ${{ needs.preflight.outputs.mode == 'stage' || needs.preflight.outputs.mode == 'publish' }}
    runs-on: warp-ubuntu-latest-x64-8x
    concurrency:
      group: docker-build-${{ vars.WARPBUILD_DOCKER_BUILDER_PROFILE }}-${{ matrix.architecture }}
      cancel-in-progress: false
      queue: max
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            architecture: amd64
          - platform: linux/arm64
            architecture: arm64
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.preflight.outputs.commit }}
          persist-credentials: false

      - name: Log in to the Container registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Build and stage Docker images
        uses: WarpBuilds/bake-action@cb88c8ea0c887c0d1a3dcb534e71bd68a015e2d6 # v6.7.7
        with:
          source: .
          files: ./docker-bake.hcl
          targets: validate
          push: true
          profile-name: ${{ vars.WARPBUILD_DOCKER_BUILDER_PROFILE }}
          pull: true
          set: |
            *.platform=${{ matrix.platform }}
            *.args.CREATED=${{ needs.preflight.outputs.created }}
            *.args.VERSION=${{ needs.preflight.outputs.tag }}
            *.args.COMMIT=${{ needs.preflight.outputs.commit }}
            node.tags=${{ env.REGISTRY_PREFIX }}/miden-node:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            validator.tags=${{ env.REGISTRY_PREFIX }}/miden-validator:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            note-transport.tags=${{ env.REGISTRY_PREFIX }}/miden-note-transport:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            ntx-builder.tags=${{ env.REGISTRY_PREFIX }}/miden-ntx-builder:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            remote-prover.tags=${{ env.REGISTRY_PREFIX }}/miden-remote-prover:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            network-monitor.tags=${{ env.REGISTRY_PREFIX }}/miden-network-monitor:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            funding-service.tags=${{ env.REGISTRY_PREFIX }}/miden-funding-service:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            node-tps-benchmark.tags=${{ env.REGISTRY_PREFIX }}/miden-node-tps-benchmark:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}
            usdcx-genesis.tags=${{ env.REGISTRY_PREFIX }}/miden-usdcx-genesis:${{ needs.preflight.outputs.immutable_tag }}-${{ matrix.architecture }}

  kache-summary:
    name: Summarize Kache cache
    needs: validate-images
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Download amd64 Kache cache report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: kache-report-amd64
          path: ${{ runner.temp }}/kache-reports/amd64

      - name: Download arm64 Kache cache report
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: kache-report-arm64
          path: ${{ runner.temp }}/kache-reports/arm64

      - name: Add Kache cache summary
        run: |
          {
            echo "<details>"
            echo "<summary>Docker Kache stats</summary>"
            echo
            for architecture in amd64 arm64; do
              echo "<details>"
              printf '<summary><code>linux/%s</code></summary>\n\n' "${architecture}"
              cat "${RUNNER_TEMP}/kache-reports/${architecture}/kache-report.md"
              echo
              echo "</details>"
              echo
            done
            echo "</details>"
          } >> "${GITHUB_STEP_SUMMARY}"

  dry-run-compose:
    name: Dry-run docker compose publishing
    needs: preflight
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.preflight.outputs.commit }}
          persist-credentials: false

      - name: Dry-run Compose publishing
        # Pin independently so the checked-out caller-provided ref cannot replace this action's code.
        uses: 0xMiden/node/.github/actions/publish-compose@3df9adbec870c8039d38cc946b2dc79ec9cf7e59
        env:
          MIDEN_NOTE_TRANSPORT_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-note-transport:${{ needs.preflight.outputs.tag }}
          MIDEN_NODE_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-node:${{ needs.preflight.outputs.tag }}
          MIDEN_VALIDATOR_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-validator:${{ needs.preflight.outputs.tag }}
          MIDEN_NTX_BUILDER_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-ntx-builder:${{ needs.preflight.outputs.tag }}
          MIDEN_REMOTE_PROVER_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-remote-prover:${{ needs.preflight.outputs.tag }}
          MIDEN_NETWORK_MONITOR_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-network-monitor:${{ needs.preflight.outputs.tag }}
          MIDEN_FUNDING_SERVICE_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-funding-service:${{ needs.preflight.outputs.tag }}
          MIDEN_USDCX_GENESIS_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-usdcx-genesis:${{ needs.preflight.outputs.tag }}
        with:
          compose-file: docker-compose.yml
          mode: dry-run
          package: miden-local-network
          registry-prefix: ${{ env.REGISTRY_PREFIX }}
          tag: ${{ needs.preflight.outputs.tag }}

  promote-images:
    name: Publish Docker images
    needs: [preflight, stage-images, dry-run-compose]
    if: >-
      ${{
        always() &&
        needs.preflight.result == 'success' &&
        needs.dry-run-compose.result == 'success' &&
        (
          (needs.preflight.outputs.mode == 'publish' && needs.stage-images.result == 'success') ||
          (needs.preflight.outputs.mode == 'promote' && needs.stage-images.result == 'skipped')
        )
      }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Publish staged images
        env:
          IMAGES: ${{ needs.preflight.outputs.images }}
          IMMUTABLE_TAG: ${{ needs.preflight.outputs.immutable_tag }}
          TAG: ${{ needs.preflight.outputs.tag }}
        run: |
          set -euo pipefail

          mapfile -t components < <(jq -r '.[]' <<< "${IMAGES}")
          for component in "${components[@]}"; do
            image="${REGISTRY_PREFIX}/miden-${component}"
            docker buildx imagetools create --dry-run \
              "${image}:${IMMUTABLE_TAG}-amd64" \
              "${image}:${IMMUTABLE_TAG}-arm64" \
              > /dev/null
          done

          for component in "${components[@]}"; do
            image="${REGISTRY_PREFIX}/miden-${component}"
            docker buildx imagetools create \
              --tag "${image}:${TAG}" \
              --tag "${image}:${IMMUTABLE_TAG}" \
              "${image}:${IMMUTABLE_TAG}-amd64" \
              "${image}:${IMMUTABLE_TAG}-arm64"
          done

  publish-compose:
    name: Publish Compose
    needs: [preflight, promote-images]
    if: >-
      ${{
        always() &&
        needs.preflight.result == 'success' &&
        needs.promote-images.result == 'success'
      }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.preflight.outputs.commit }}
          persist-credentials: false

      - name: Log in to the Container registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Publish Compose application
        # Pin independently so the checked-out caller-provided ref cannot replace this action's code.
        uses: 0xMiden/node/.github/actions/publish-compose@3df9adbec870c8039d38cc946b2dc79ec9cf7e59
        env:
          MIDEN_NOTE_TRANSPORT_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-note-transport:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_NODE_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-node:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_VALIDATOR_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-validator:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_NTX_BUILDER_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-ntx-builder:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_REMOTE_PROVER_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-remote-prover:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_NETWORK_MONITOR_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-network-monitor:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_FUNDING_SERVICE_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-funding-service:${{ needs.preflight.outputs.immutable_tag }}
          MIDEN_USDCX_GENESIS_IMAGE: ${{ env.REGISTRY_PREFIX }}/miden-usdcx-genesis:${{ needs.preflight.outputs.immutable_tag }}
        with:
          compose-file: docker-compose.yml
          mode: publish
          package: miden-local-network
          registry-prefix: ${{ env.REGISTRY_PREFIX }}
          tag: ${{ needs.preflight.outputs.tag }}