DockerCI.yml

name: Docker CI

on:
  pull_request:
    branches: ["main"]
  push:
    branches: ["main"]
    tags: ["*"]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  compute-base-build-tag:
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.out.outputs.tag }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Create Tag
        id: out
        run: echo "tag=${{ hashFiles('Dockerfile','rust-toolchain.toml') }}" >> "$GITHUB_OUTPUT"
  build-base:
    needs: compute-base-build-tag
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Pull Cached Base Image
        run: |
          if docker pull ghcr.io/${{ github.repository }}/base:${{ needs.compute-base-build-tag.outputs.image_tag }}; then
            echo "CACHE_HIT=true" >> $GITHUB_ENV
          else
            echo "CACHE_HIT=false" >> $GITHUB_ENV
          fi
      - name: Set up Docker Buildx
        if: env.CACHE_HIT == 'false'
        uses: docker/setup-buildx-action@v3
      - name: Build and Push Base Image (if not cached)
        if: env.CACHE_HIT == 'false'
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          target: base
          push: true
          tags: ghcr.io/${{ github.repository }}/base:${{ needs.compute-base-build-tag.outputs.image_tag }}
  fmt:
    needs: [compute-base-build-tag, build-base]
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/${{ github.repository }}/base:${{ needs.compute-base-build-tag.outputs.image_tag }}
      options: --user 1001:1001
    concurrency: 
      group: ${{ github.workflow }}-${{ github.ref }}-fmt
      cancel-in-progress: true
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Check formatting
        run: cargo fmt -- --check
  clippy:
    needs: [compute-base-build-tag, build-base]
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/${{ github.repository }}/base:${{ needs.compute-base-build-tag.outputs.image_tag }}
      options: --user 1001:1001
    concurrency: 
      group: ${{ github.workflow }}-${{ github.ref }}-clippy
      cancel-in-progress: true
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Cache Cargo Target Directory
        uses: actions/cache@v4
        with:
          path: target
          key: clippy-base-${{ needs.compute-base-build-tag.outputs.image_tag }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            clippy-base-${{ needs.compute-base-build-tag.outputs.image_tag }}-
      - name: Clippy
        run: cargo clippy --all-targets -- -Dclippy::all -D warnings
  generate-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.get-matrix.outputs.matrix }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
      - name: Restore Cached Matrix
        id: cache-matrix
        uses: actions/cache@v4
        with:
          path: matrix.json
          key: matrix-${{ hashFiles('Cargo.toml', 'Cargo.lock') }}
      - name: Extract Cargo Workspace Members (if not cached)
        if: steps.cache-matrix.outputs.cache-hit != 'true'
        run: |
          set -e
          cargo metadata --format-version=1 | jq -c '[.workspace_members[] | split("#")[0] | split("/") | last | gsub("_"; "-") | select(. != "metrics")]' > matrix.json
      - name: Save Matrix to Output
        id: get-matrix
        run: echo "matrix=$(cat matrix.json)" >> $GITHUB_OUTPUT
  tests:
    needs: [compute-base-build-tag, build-base, generate-matrix]
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/${{ github.repository }}/base:${{ needs.compute-base-build-tag.outputs.image_tag }}
      options: --user 1001:1001
    strategy:
      fail-fast: false
      matrix:
        package: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
    concurrency: 
      group: ${{ github.workflow }}-${{ github.ref }}-tests-${{ matrix.package }}
      cancel-in-progress: true
    services:
      postgres:
        image: postgres:14.9-alpine
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
            - 5432:5432
      localstack:
        image: localstack/localstack:latest
        env:
          SERVICES: s3
          EAGER_SERVICE_LOADING: 1
        ports:
          - 4566:4566
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Cache Cargo Target Directory
        # Anything above 4min run
        if: contains('["ingest", "iot-config", "iot-packet-verifier", "iot-verifier", "mobile-packet-verifier", "mobile-verifier", "price", "solana"]', matrix.package)
        uses: actions/cache@v4
        with:
          path: target
          key: tests-${{ matrix.package }}-base-${{ needs.compute-base-build-tag.outputs.image_tag }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            tests-${{ matrix.package }}-base-${{ needs.compute-base-build-tag.outputs.image_tag }}-
      - name: Run tests
        env:
          DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
          AWSLOCAL_ENDPOINT: "http://localstack:4566"
        run: cargo test -p ${{ matrix.package }}
  build-mobile-images:
    if: startsWith(github.ref, 'refs/tags/')
    needs: [fmt, clippy, tests]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        package: ["ingest","mobile-config","mobile-packet-verifier","mobile-verifier","price","reward-index"]
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-build-image-${{ matrix.package }}
      cancel-in-progress: true
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and Push Base Image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          target: runner
          push: true
          tags: ghcr.io/${{ github.repository }}/${{ matrix.package }}:${{ github.ref_name }}
          build-args: |
            PACKAGE=${{ matrix.package }}
  upload-iot-releases:
    needs: [fmt, clippy, tests]
    runs-on: ubuntu-latest
    container:
      image: ubuntu:20.04
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-upload-release
      cancel-in-progress: true
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Show Inputs
        run: |
          echo "Release Version: ${{ github.event.inputs.release_version }}"

      - name: Install Dependencies
        run: |
          export DEBIAN_FRONTEND=noninteractive
          apt-get update
          apt-get install -y tzdata curl build-essential pkg-config libssl-dev clang lld cmake unzip
          ln -fs /usr/share/zoneinfo/UTC /etc/localtime
          dpkg-reconfigure -f noninteractive tzdata

      - name: Checkout
        uses: actions/checkout@v4

      - name: Rust install
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          cache-shared-key: release

      - name: Install Protoc
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Release
        run: AWS_LC_SYS_CMAKE_BUILDER=1 cargo build --release -p reward-index -p price -p ingest -p iot-config -p iot-packet-verifier -p iot-verifier -p poc-entropy

      - name: Extract binaries and cleanup
        run: |
          mkdir -p /tmp/binaries
          mv target/release/reward-index /tmp/binaries/
          mv target/release/price /tmp/binaries/
          mv target/release/ingest /tmp/binaries/
          mv target/release/iot-config /tmp/binaries/
          mv target/release/iot-packet-verifier /tmp/binaries/
          mv target/release/iot-verifier /tmp/binaries/
          mv target/release/poc-entropy /tmp/binaries/
          echo "Before cleanup:"
          df -h
          rm -rf target/
          echo "After cleanup:"
          df -h
          mkdir -p target/release
          mv /tmp/binaries/* target/release/
          echo "Binaries restored to target/release/"

      - name: Debian packaging
        env:
          PACKAGECLOUD_API_KEY: ${{ secrets.PACKAGECLOUD_API_KEY }}
          RELEASE_VERSION: ${{ github.event.inputs.release_version }}
        run: |
          chmod +x ./.github/scripts/make_debian.sh
          ./.github/scripts/make_debian.sh