dockerhub-deploy.yml

name: Build and Push to Docker Hub

on:
  workflow_dispatch:

concurrency:
  group: build-and-push-${{ github.ref }}
  cancel-in-progress: true

concurrency:
  group: build-and-push-${{ github.ref }}
  cancel-in-progress: true

env:
  DOCKERHUB_REGISTRY: docker.io

jobs:
  # Job 1: Download binaries (shared by both builds)
  download-binaries:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        lfs: false

    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v2
      with:
        credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}

    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v2

    - name: Download LLVM binaries from GCP
      env:
        GCP_BUCKET: llvmbins
        TARBALL_NAME: llvm-obfuscator-binaries.tar.gz
      run: |
        echo "=========================================="
        echo "Downloading LLVM binaries from GCP"
        echo "=========================================="

        mkdir -p cmd/llvm-obfuscator/plugins

        # Download single tarball (FAST - ~2 mins)
        echo "Downloading pre-built tarball..."
        if gsutil cp "gs://${GCP_BUCKET}/${TARBALL_NAME}" /tmp/${TARBALL_NAME} 2>/dev/null; then
          echo "✅ Tarball found! Extracting..."
          tar -xzf /tmp/${TARBALL_NAME} -C cmd/llvm-obfuscator/plugins/
          rm /tmp/${TARBALL_NAME}
        else
          echo "❌ Tarball not found. Run: ./scripts/gcp-binary-manager.sh init"
          exit 1
        fi

        # Make binaries executable
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/clang || true
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/opt || true
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/mlir-opt || true
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/mlir-translate || true
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/clangir || true
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/lld || true
        chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/upx || true

        echo "✅ Binaries ready"
        ls -lh cmd/llvm-obfuscator/plugins/linux-x86_64/ | head -10

    - name: Verify binaries
      run: |
        if [ ! -f "cmd/llvm-obfuscator/plugins/linux-x86_64/clang" ]; then
          echo "❌ clang not found"; exit 1
        fi
        if [ ! -f "cmd/llvm-obfuscator/plugins/linux-x86_64/opt" ]; then
          echo "❌ opt not found"; exit 1
        fi
        if [ ! -f "cmd/llvm-obfuscator/plugins/linux-x86_64/LLVMObfuscationPlugin.so" ]; then
          echo "❌ plugin not found"; exit 1
        fi
        # UPX is optional - log if present
        if [ -f "cmd/llvm-obfuscator/plugins/linux-x86_64/upx" ]; then
          echo "✅ Custom UPX binary found"
        else
          echo "ℹ️  Custom UPX not found (will use system UPX as fallback)"
        fi
        echo "✅ All required binaries verified"

    - name: Upload plugins as artifact
      uses: actions/upload-artifact@v4
      with:
        name: llvm-plugins
        path: |
          cmd/llvm-obfuscator/plugins/linux-x86_64
          cmd/llvm-obfuscator/plugins/llvm-mingw
        retention-days: 1

    - name: Upload macOS SDK as artifact
      uses: actions/upload-artifact@v4
      with:
        name: macos-sdk
        path: |
          cmd/llvm-obfuscator/plugins/macos-sdk
          !cmd/llvm-obfuscator/plugins/macos-sdk/**/man/**
          !cmd/llvm-obfuscator/plugins/macos-sdk/**/*.3pm
        retention-days: 1

  # Job 2: Build and push backend (runs in parallel with frontend)
  build-backend:
    needs: download-binaries
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Download plugins artifact
      uses: actions/download-artifact@v4
      with:
        name: llvm-plugins
        path: cmd/llvm-obfuscator/plugins

    - name: Download macOS SDK artifact
      uses: actions/download-artifact@v4
      with:
        name: macos-sdk
        path: cmd/llvm-obfuscator/plugins/macos-sdk

    - name: Make binaries executable
      run: chmod +x cmd/llvm-obfuscator/plugins/linux-x86_64/* 2>/dev/null || true

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.DOCKERHUB_REGISTRY }}/${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-backend
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=raw,value=latest,enable={{is_default_branch}}
          type=raw,value=patched,enable={{is_default_branch}}

    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: ./cmd/llvm-obfuscator
        file: ./cmd/llvm-obfuscator/Dockerfile.backend
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: |
          type=gha,scope=backend
          type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-backend:buildcache
        cache-to: |
          type=gha,mode=max,scope=backend
          type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-backend:buildcache,mode=max
        platforms: linux/amd64
        build-args: BUILDKIT_INLINE_CACHE=1

  # Job 3: Build and push frontend (runs in parallel with backend)
  build-frontend:
    needs: download-binaries
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.DOCKERHUB_REGISTRY }}/${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-frontend
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=raw,value=latest,enable={{is_default_branch}}
          type=raw,value=patched,enable={{is_default_branch}}

    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: ./cmd/llvm-obfuscator/frontend
        file: ./cmd/llvm-obfuscator/frontend/Dockerfile.frontend
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: |
          type=gha,scope=frontend
          type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-frontend:buildcache
        cache-to: |
          type=gha,mode=max,scope=frontend
          type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-frontend:buildcache,mode=max
        platforms: linux/amd64
        build-args: BUILDKIT_INLINE_CACHE=1

  # Job 4: Notify completion
  notify:
    needs: [build-backend, build-frontend]
    runs-on: ubuntu-latest

    steps:
    - name: Deployment summary
      run: |
        echo "🚀 Docker images built and pushed successfully!"
        echo ""
        echo "📦 Images:"
        echo "  - ${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-backend:latest"
        echo "  - ${{ secrets.DOCKERHUB_USERNAME }}/llvm-obfuscator-frontend:latest"