dev-container.yml

name: "Build: Dev Container"

on:
  push:
    branches: [dev]
    paths:
      - 'frontend/**'
      - 'backend/**'
      - 'build/**'
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

# Cancel an in-flight dev build when a newer commit is pushed to dev.
concurrency:
  group: dev-container
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4
        with:
          ref: dev
          fetch-depth: 0
          fetch-tags: true

      - name: Resolve version from latest release tag
        id: version
        run: |
          TAG=$(git tag --sort=-v:refname | head -1)
          TAG=${TAG:-v0.0.0}
          BASE="${TAG#v}"
          # Use the checked-out tree's SHA, not github.sha — those diverge when
          # workflow_dispatch is run from a branch other than dev.
          FULL_SHA=$(git rev-parse HEAD)
          SHORT_SHA=$(git rev-parse --short=7 HEAD)
          echo "app_version=${BASE}+dev.${SHORT_SHA}" >> $GITHUB_OUTPUT
          echo "full_sha=${FULL_SHA}" >> $GITHUB_OUTPUT
          echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT

      - name: Set lower case image name
        run: echo "IMAGE_NAME_LC=${REPO,,}" >> $GITHUB_ENV
        env:
          REPO: ${{ github.repository }}

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      # Persist the Next.js compile cache and yarn cache across runs. These are
      # BuildKit cache *mounts* (Dockerfile lines 67/85) — they are NOT exported by
      # type=gha, so without this every CI build is a cold Next.js compile. Shared
      # key prefix with the nightly workflow (identical Dockerfile/base image).
      # The key rotates weekly, not per-run. A github.run_id key can never match, so
      # actions/cache missed every build and its post step saved a fresh ~1.7 GB entry
      # every time - hundreds of them, of which only the newest was ever read back
      # (restore-keys resolves to the most recent prefix match). Keyed on the lockfile
      # plus an ISO week, repeat builds hit exactly and save nothing, while the Next.js
      # compile cache still refreshes often enough not to go cold.
      - name: Compute cache epoch
        id: cache-epoch
        run: echo "week=$(date -u +%Y-%W)" >> $GITHUB_OUTPUT

      - name: Restore frontend build caches
        id: build-cache
        uses: actions/cache@v4
        with:
          path: |
            yarn-cache
            next-cache
          key: cipp-frontend-cache-dev-${{ hashFiles('frontend/yarn.lock') }}-${{ steps.cache-epoch.outputs.week }}
          restore-keys: |
            cipp-frontend-cache-dev-${{ hashFiles('frontend/yarn.lock') }}-
            cipp-frontend-cache-dev-

      - name: Inject build caches into BuildKit
        uses: reproducible-containers/buildkit-cache-dance@v3.4.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
          cache-map: |
            {
              "yarn-cache": "/usr/local/share/.cache/yarn",
              "next-cache": "/build/.next/cache"
            }
          skip-extraction: ${{ steps.build-cache.outputs.cache-hit }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: build/Dockerfile
          push: true
          cache-from: type=gha,scope=dev
          cache-to: type=gha,mode=max,scope=dev
          build-args: |
            APP_VERSION=${{ steps.version.outputs.app_version }}
            COMMIT_SHA=${{ steps.version.outputs.full_sha }}
            IMAGE_TAG=dev
            BUILD_DATE=${{ steps.version.outputs.build_date }}
            DOTNET_REGISTRY=${{ vars.DOTNET_REGISTRY || 'ghcr.io/cyberdrain' }}
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:dev
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.description=CIPP - Dev Build
            org.opencontainers.image.revision=${{ steps.version.outputs.full_sha }}
            org.opencontainers.image.version=${{ steps.version.outputs.app_version }}
            org.opencontainers.image.created=${{ steps.version.outputs.build_date }}