devcontainer-image.yml

name: devcontainer image

# Source changes qualify through devcontainer-image-pr.yml. Dispatch publication
# on main only after the image build path is qualified for publication.
on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: devcontainer-image-main
  cancel-in-progress: true

env:
  GHCR_IMAGE: ghcr.io/durable-workflow/sample-app-devcontainer
  DOCKERHUB_IMAGE: durableworkflow/sample-app-devcontainer

jobs:
  build:
    name: Build ${{ matrix.platform }}
    if: github.ref == 'refs/heads/main'
    environment: devcontainer-publication
    runs-on: ${{ matrix.runner }}
    timeout-minutes: ${{ matrix.timeout_minutes }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
            suffix: amd64
            timeout_minutes: 20
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            suffix: arm64
            timeout_minutes: 30
    env:
      REVISION_TAG: sha-${{ github.sha }}-run-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Check out the accepted central APT preflight
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: durable-workflow/.github
          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
          path: .central-apt-source
          persist-credentials: false
      - name: Verify the central APT source identity
        run: |
          test "$(git -C .central-apt-source rev-parse HEAD)" = 18783be6bef737cc778e4c7282a8797e39daa61a
          echo '2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576  .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh' | sha256sum --check --strict
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Sign in to GitHub Container Registry
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Sign in to Docker Hub
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          username: durableworkflow
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build and publish immutable architecture image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          file: .devcontainer/docker/Dockerfile
          platforms: ${{ matrix.platform }}
          no-cache: true
          pull: true
          push: true
          provenance: mode=max
          # A custom selection resets the scanner to directory defaults. Restore
          # all five image-only catalogers in pinned Syft alongside Cargo.
          # The action re-parses this as CSV and rejoins fields without quoting,
          # so the comma-bearing selection is double-escaped ("" -> ") to reach
          # buildx as one quoted field.
          sbom: 'generator=docker/buildkit-syft-scanner@sha256:873a7458c3c8ac8e32c7b796c10e1600b07b963d2aa000a72a2d97aaaa2d6315,"""SELECT_CATALOGERS=image,file,+sbom-cataloger,+rust-cargo-lock-cataloger,+bitnami-cataloger,+conan-info-cataloger,+javascript-package-cataloger,+php-composer-installed-cataloger,+ruby-installed-gemspec-cataloger"""'
          tags: |
            ${{ env.GHCR_IMAGE }}:${{ env.REVISION_TAG }}-${{ matrix.suffix }}
            ${{ env.DOCKERHUB_IMAGE }}:${{ env.REVISION_TAG }}-${{ matrix.suffix }}
          build-args: VCS_REF=${{ github.sha }}

  assemble:
    name: Assemble multi-platform image
    if: github.ref == 'refs/heads/main'
    environment: devcontainer-publication
    needs: [build]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      packages: write
    outputs:
      revision_tag: ${{ steps.identity.outputs.revision_tag }}
    steps:
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Sign in to GitHub Container Registry
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Sign in to Docker Hub
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          username: durableworkflow
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Set immutable tag
        id: identity
        run: echo "revision_tag=sha-${GITHUB_SHA}-run-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
      - name: Assemble registry indexes
        env:
          REVISION_TAG: ${{ steps.identity.outputs.revision_tag }}
        run: |
          docker buildx imagetools create \
            -t "$GHCR_IMAGE:$REVISION_TAG" \
            "$GHCR_IMAGE:$REVISION_TAG-amd64" \
            "$GHCR_IMAGE:$REVISION_TAG-arm64"
          docker buildx imagetools create \
            -t "$DOCKERHUB_IMAGE:$REVISION_TAG" \
            "$DOCKERHUB_IMAGE:$REVISION_TAG-amd64" \
            "$DOCKERHUB_IMAGE:$REVISION_TAG-arm64"

  scan:
    name: Scan exact public platform SBOMs
    if: github.ref == 'refs/heads/main'
    needs: [assemble]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    outputs:
      index_digest: ${{ steps.security.outputs.index_digest }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Verify anonymous attestations and scan both platforms
        id: security
        env:
          REVISION_TAG: ${{ needs.assemble.outputs.revision_tag }}
        run: >-
          python3 scripts/ci/scan-devcontainer-image.py
          "$GHCR_IMAGE:$REVISION_TAG" "$DOCKERHUB_IMAGE:$REVISION_TAG"
          --revision "$GITHUB_SHA"
          --output "$RUNNER_TEMP/devcontainer-security"
          --github-output "$GITHUB_OUTPUT"
      - name: Retain exact scan receipts
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: devcontainer-security-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/devcontainer-security/*.json
          if-no-files-found: warn
          retention-days: 7

  qualify:
    name: Qualify ${{ matrix.platform }}
    if: github.ref == 'refs/heads/main'
    needs: [assemble, scan]
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Use a credential-free Docker configuration
        run: |
          mkdir -p /tmp/docker-anonymous
          printf '%s\n' '{"auths":{}}' > /tmp/docker-anonymous/config.json
          echo 'DOCKER_CONFIG=/tmp/docker-anonymous' >> "$GITHUB_ENV"
      - name: Qualify the published image
        env:
          DEVCONTAINER_EXPECTED_REVISION: ${{ github.sha }}
          DEVCONTAINER_REQUIRE_ANONYMOUS_PULL: '1'
          DEVCONTAINER_REQUIRE_PUBLISHED_ATTESTATIONS: '1'
        run: >-
          scripts/ci/qualify-devcontainer-image.sh
          "$GHCR_IMAGE@${{ needs.scan.outputs.index_digest }}"
          "${{ matrix.platform }}"

  promote:
    name: Publish main channel
    if: github.ref == 'refs/heads/main'
    environment: devcontainer-publication
    needs: [assemble, scan, qualify]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Sign in to GitHub Container Registry
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Sign in to Docker Hub
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          username: durableworkflow
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Promote the qualified image
        env:
          INDEX_DIGEST: ${{ needs.scan.outputs.index_digest }}
        run: |
          docker buildx imagetools create -t "$GHCR_IMAGE:main" "$GHCR_IMAGE@$INDEX_DIGEST"
          docker buildx imagetools create -t "$DOCKERHUB_IMAGE:main" "$DOCKERHUB_IMAGE@$INDEX_DIGEST"
      - name: Verify both public indexes
        env:
          INDEX_DIGEST: ${{ needs.scan.outputs.index_digest }}
        run: |
          anonymous="$(mktemp)"
          printf '%s\n' '{"auths":{}}' > "$anonymous"
          oras_image="$(python3 -c 'import json; print(json.load(open("scripts/ci/devcontainer-security.json"))["oras_image"])')"
          for image in "$GHCR_IMAGE:main" "$DOCKERHUB_IMAGE:main"; do
            raw="$(mktemp)"
            case "$image" in durableworkflow/*) image="docker.io/$image" ;; esac
            docker run --rm --user "$(id -u):$(id -g)" \
              --mount "type=bind,src=$anonymous,dst=/anonymous.json,readonly" \
              --entrypoint oras "$oras_image" manifest fetch \
              --registry-config /anonymous.json --output - "$image" > "$raw"
            python3 - "$raw" "$INDEX_DIGEST" <<'PY'
          import hashlib
          import json
          import sys

          raw = open(sys.argv[1], 'rb').read()
          if 'sha256:' + hashlib.sha256(raw).hexdigest() != sys.argv[2]:
              raise SystemExit('public main index differs from the scanned and qualified digest')
          manifest = json.loads(raw)
          platforms = {
              (item.get('platform') or {}).get('architecture')
              for item in manifest.get('manifests', [])
              if (item.get('platform') or {}).get('os') == 'linux'
          }
          if not {'amd64', 'arm64'} <= platforms:
              raise SystemExit(f'missing image platforms: {platforms}')
          PY
            rm -f "$raw"
          done
          rm -f "$anonymous"