docker-publish.yml

name: Docker

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

on:
  schedule:
    - cron: '31 10 * * *'
  push:
    branches: [ "main" ]
    # Publish semver tags as releases.
    tags: [ 'v*.*.*' ]
  pull_request:
    branches: [ "main" ]

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}


jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
      - name: Checkout verification
        uses: actions/checkout@v5
      - name: Build the site in the jekyll/builder container
        run: |
          docker run \
          -v ${{ github.workspace }}:/srv/jekyll -v ${{ github.workspace }}/_site:/srv/jekyll/_site \
          jekyll/builder:latest /bin/bash -c "chmod -R 777 /srv/jekyll && jekyll build --future"
      - name: Build the Docker image
        run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)
        # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad #v4.0.0
        with:
          cosign-release: 'v2.2.4'

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
      - name: Run Microsoft Security DevOps
        uses: microsoft/security-devops-action@v1.12.0
        id: msdo
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.14"
      - name: ci-config branch
        run: |
          git -c protocol.version=2 clone \
            --no-tags \
            --single-branch \
            -b ci-config \
            --depth 1 \
            --no-checkout \
            --filter=blob:none \
            https://github.com/${{ github.repository }} \
            config-repo &&
          cd config-repo &&
          git checkout HEAD -- ci/config || true
      - id: check-ref
        name: ci-config check
        run: |
          enabled=yes
          if test -x config-repo/ci/config/allow-ref
          then
            echo "::warning::ci/config/allow-ref is deprecated; use CI_BRANCHES instead"
            if ! config-repo/ci/config/allow-ref '${{ github.ref }}'
            then
              enabled=no
            fi
          fi
          skip_concurrent=yes
          if test -x config-repo/ci/config/skip-concurrent &&
             ! config-repo/ci/config/skip-concurrent '${{ github.ref }}'
          then
            skip_concurrent=no
          fi
          echo "enabled=$enabled" >>$GITHUB_OUTPUT
          echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
      - name: skip test
        id: skip-if-redundant
        uses: actions/github-script@v8
        if: steps.check-ref.outputs.enabled == 'yes'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            try {
              const { data: run } = await github.rest.actions.getWorkflowRun({
                owner: context.repo.owner,
                repo: context.repo.repo,
                run_id: context.runId,
              });
              const workflow_id = run.workflow_id;
              const head_sha = run.head_sha;
              const tree_id = run.head_commit.tree_id;
              const { data: runs } = await github.rest.actions.listWorkflowRuns({
                owner: context.repo.owner,
                repo: context.repo.repo,
                per_page: 500,
                status: 'success',
                workflow_id,
              });
              for (const run of runs.workflow_runs) {
                if (head_sha === run.head_sha) {
                  core.warning(`Successful run for the commit ${head_sha}: ${run.html_url}`);
                  core.setOutput('enabled', ' but skip');
                  break;
                }
                if (run.head_commit && tree_id === run.head_commit.tree_id) {
                  core.warning(`Successful run for the tree ${tree_id}: ${run.html_url}`);
                  core.setOutput('enabled', ' but skip');
                  break;
                }
              }
            } catch (e) {
              core.warning(e);
            }
      - name: Install NVM
        run: |
          curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
          export NVM_DIR="$HOME/.nvm"
          [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
          nvm install 22
          
      - name: Verify Node.js version
        run: |
          node -v
          npm -v
          
      - name: Check NVM terminal
        run: |
          export NVM_DIR="$HOME/.nvm"
          [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
          [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
      - name: initialize vcpkg
        uses: actions/checkout@v5
        with:
          repository: 'microsoft/vcpkg'
          path: 'compat/vcbuild/vcpkg'
      - name: download vcpkg artifacts
        uses: git-for-windows/get-azure-pipelines-artifact@v0
        with:
          repository: git/git
          definitionId: 9
      - name: upload tracked files and build artifacts
        uses: actions/upload-artifact@v5
        with:
          name: vs-artifacts
          path: artifacts
  sanitize:
    name: build
    runs-on: ubuntu-24.04
    needs: [build]
    env:
      USE_NINJA: "1"
      CC: "clang"
      WASM2C_CFLAGS: "-march=x86-64-v2"
    strategy:
      matrix:
        sanitizer: [asan, ubsan]
        type: [release]
    steps:
      - uses: actions/setup-python@v6
        with:
          python-version: '3.x'
      - uses: actions/checkout@v5
        with:
          submodules: true