build.yaml

name: Build-Publish

on:
  # Trigger on tags like v1.0.0
  push:
    tags:
      - 'v*'
    # Trigger on PR merges to main
    branches:
      - main
  # Allow manual trigger
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write  # push images to ghcr.io

    strategy:
      matrix:
        image_config:
          # PDP config bootstrap — seeds Keycloak with the AIAC IdP
          # configuration (realms, clients, scopes).
          - name: aiac-pdp-config
            context: ./src/aiac/idp/service/configuration/keycloak
            dockerfile: Dockerfile

          # PDP policy engine — OPA sidecar serving the decision policies.
          - name: aiac-pdp-policy-opa
            context: ./src
            dockerfile: aiac/pdp/service/policy/opa/Dockerfile

          # Policy model store — serves the policy/model artifacts.
          - name: aiac-policy-model-store
            context: ./src
            dockerfile: aiac/policy/model_store/service/Dockerfile

          # AIAC agent controller — the orchestration agent runtime.
          - name: aiac-agent
            context: ./src
            dockerfile: aiac/agent/controller/Dockerfile

          # Keycloak event-listener SPI — self-contained multi-stage build
          # (builds the shaded JAR with Maven, bakes it into Keycloak via
          # kc.sh build). KEYCLOAK_IMAGE defaults inside the Dockerfile.
          - name: aiac-keycloak-event-listener
            context: ./keycloak-spi
            dockerfile: Dockerfile

    steps:
      # 1. Checkout code
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      # 2. Set up QEMU for multi-arch builds
      - name: Set up QEMU
        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a  # v4

      # 3. Set up Docker Buildx
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4

      # 4. Log in to GitHub Container Registry
      - name: Log in to ghcr.io
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # 5. Generate image tag
      - name: Generate image tag
        id: tag
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            echo "tag=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          else
            # Use branch name or 'manual' for workflow_dispatch
            BRANCH="${{ github.ref_name }}"
            # Sanitize branch name (replace / with -)
            BRANCH="${BRANCH//\//-}"
            echo "tag=${BRANCH}-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
          fi

      # 6. Extract Docker metadata
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6
        with:
          images: ghcr.io/${{ github.repository }}/${{ matrix.image_config.name }}
          tags: |
            # Always use the computed tag
            type=raw,value=${{ steps.tag.outputs.tag }}
            # Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}

      # 7. Build and push image
      - name: Build and push ${{ matrix.image_config.name }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7
        with:
          context: ${{ matrix.image_config.context }}
          file: ${{ matrix.image_config.context }}/${{ matrix.image_config.dockerfile }}
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}