docker.yml

name: Docker

on:
  push:
    branches:
      - master
      - 'Stable*'
    tags:
      - 'v*'
    paths-ignore:
      - 'docs/**'
  pull_request:
    paths-ignore:
      - 'docs/**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

permissions:
  contents: read
  actions: read

jobs:
  changes:
    uses: ./.github/workflows/_detect-changes.yml
    with:
      platform: docker-linux docker-android

  plan-builds:
    name: Plan Docker Builds
    runs-on: ubuntu-latest
    needs: changes
    if: always() && !cancelled()
    timeout-minutes: 5
    outputs:
      matrix: ${{ steps.plan.outputs.matrix }}
      has_jobs: ${{ steps.plan.outputs.has_jobs }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Checkout planner
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
          # Bootstrap shim (ci_bootstrap.py + tools/_bootstrap.py + common/__init__.py + common/gh_actions.py)
          # also appears in linux.yml (debug-matrix), pr-checks.yml (size), _cache-cleanup.yml. Keep aligned —
          # GHA composite actions can't run before checkout, so this list can't be deduplicated structurally.
          sparse-checkout: |
            .github/scripts/plan_docker_builds.py
            .github/scripts/ci_bootstrap.py
            deploy/docker/variants.json
            tools/_bootstrap.py
            tools/common/__init__.py
            tools/common/file_traversal.py
            tools/common/gh_actions.py
          sparse-checkout-cone-mode: false
          persist-credentials: false

      - name: Plan matrix
        id: plan
        env:
          EVENT_NAME: ${{ github.event_name }}
          LINUX: ${{ needs.changes.outputs.docker_linux }}
          ANDROID: ${{ needs.changes.outputs.docker_android }}
        run: python3 "${GITHUB_WORKSPACE}/.github/scripts/plan_docker_builds.py"

  build:
    name: Docker ${{ matrix.platform }}
    runs-on: >-
      ${{
        github.repository_owner == 'mavlink' &&
        (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
        format('runs-on={0}/runner=linux-x64-builder', github.run_id) ||
        'ubuntu-latest'
      }}
    needs: [changes, plan-builds]
    if: always() && !cancelled() && needs.plan-builds.outputs.has_jobs == 'true'
    timeout-minutes: 120
    permissions:
      contents: read
      security-events: write
      packages: write

    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.plan-builds.outputs.matrix) }}

    defaults:
      run:
        shell: bash

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Enable RunsOn magic cache
        if: github.repository_owner == 'mavlink' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: runs-on/action@v2
        with:
          metrics: cpu,network,memory,disk,io
          show_costs: summary

      - name: Checkout
        uses: actions/checkout@v7
        with:
          # Native package versions come from git describe and require reachable tags.
          fetch-depth: 0
          persist-credentials: false

      - name: Free Disk Space
        uses: ./.github/actions/free-disk-space

      - name: Resolve push target
        id: push-target
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          REPO: ${{ github.repository }}
          REF: ${{ github.ref }}
        run: >-
          python3 "${GITHUB_WORKSPACE}/.github/scripts/docker_helper.py" resolve-push-target
          --event-name "${EVENT_NAME}"
          --repo "${REPO}"
          --ref "${REF}"

      - name: Build with Docker
        uses: ./.github/actions/docker
        with:
          target: ${{ matrix.target }}
          variant: ${{ matrix.variant }}
          build-args: ${{ matrix.build_args }}
          fuse: ${{ matrix.fuse }}
          docker-username: ${{ secrets.DOCKERHUB_USERNAME }}
          docker-token: ${{ secrets.DOCKERHUB_TOKEN }}
          push-image: ${{ steps.push-target.outputs.ref }}

      - name: Find build artifact
        id: artifact
        run: >-
          python3 "${GITHUB_WORKSPACE}/.github/scripts/find_artifact.py"
          --build-dir "${{ github.workspace }}/build"
          --required
          --pattern "${MATRIX_ARTIFACT_PATTERN}"
        env:
          MATRIX_ARTIFACT_PATTERN: ${{ matrix.artifact_pattern }}

      # Per-distro artifact: `variant` keys the name so the parallel matrix entries
      # (linux, linux-debian, linux-fedora, linux-arch, ...) don't collide.
      - name: Upload build artifact
        if: steps.artifact.outputs.found == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: qgroundcontrol-${{ matrix.variant }}
          path: |
            ${{ steps.artifact.outputs.path }}
            ${{ github.workspace }}/build/appimagelint-report.json
          if-no-files-found: error
          retention-days: 14

      # Native distro package (.deb/.rpm/.pkg.tar.zst) alongside the AppImage on
      # x86_64 Linux variants; empty package_pattern (aarch64, Android) skips both.
      - name: Find native package
        id: package
        if: matrix.package_pattern != ''
        run: >-
          python3 "${GITHUB_WORKSPACE}/.github/scripts/find_artifact.py"
          --build-dir "${{ github.workspace }}/build"
          --top-level
          --required
          --pattern "${MATRIX_PACKAGE_PATTERN}"
        env:
          MATRIX_PACKAGE_PATTERN: ${{ matrix.package_pattern }}

      - name: Validate native package lifecycle
        if: matrix.package_pattern != '' && steps.package.outputs.found == 'true'
        shell: bash
        env:
          IMAGE: dronecode/qgroundcontrol:${{ matrix.variant }}
          PACKAGE_PATH: ${{ steps.package.outputs.path }}
        run: |
          package_dir=$(dirname "${PACKAGE_PATH}")
          package_name=$(basename "${PACKAGE_PATH}")
          docker run --rm --entrypoint /bin/bash \
            -v "${GITHUB_WORKSPACE}:/project/source:ro" \
            -v "${package_dir}:/packages:ro" \
            "${IMAGE}" \
            /project/source/deploy/docker/validate-native-package.sh "/packages/${package_name}"

      - name: Verify native package checksum
        id: package-checksum
        if: matrix.package_pattern != '' && steps.package.outputs.found == 'true'
        shell: bash
        env:
          PACKAGE_PATH: ${{ steps.package.outputs.path }}
        run: |
          set -euo pipefail
          package_dir=$(dirname "${PACKAGE_PATH}")
          package_name=$(basename "${PACKAGE_PATH}")
          checksum_path="${PACKAGE_PATH}.sha256"
          checksum_name="${package_name}.sha256"

          # CPack must emit DEB/RPM checksums. Arch's makepkg has no equivalent,
          # so produce the same sidecar before verifying and publishing it.
          if [[ ! -f "${checksum_path}" ]]; then
            if [[ "${package_name}" != *.pkg.tar.zst ]]; then
              echo "::error::Native package checksum is missing: ${checksum_path}"
              exit 1
            fi
            (cd "${package_dir}" && sha256sum "${package_name}" > "${checksum_name}")
          fi
          (cd "${package_dir}" && sha256sum --check "${checksum_name}")
          echo "path=${checksum_path}" >> "${GITHUB_OUTPUT}"

      - name: Upload native package
        if: matrix.package_pattern != '' && steps.package.outputs.found == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: qgroundcontrol-${{ matrix.variant }}-package
          path: |
            ${{ steps.package.outputs.path }}
            ${{ steps.package-checksum.outputs.path }}
          if-no-files-found: error
          retention-days: 14

      - name: Generate CPM dependency SBOM
        if: steps.artifact.outputs.found == 'true'
        run: >-
          python3 "${GITHUB_WORKSPACE}/.github/scripts/generate_cpm_sbom.py"
          --build-dir "${{ github.workspace }}/build"
          -o cpm-sbom.cdx.json

      - name: Scan SBOM with Grype
        if: steps.artifact.outputs.found == 'true'
        id: grype
        uses: anchore/scan-action@v7
        with:
          sbom: cpm-sbom.cdx.json
          fail-build: false
          severity-cutoff: high
          only-fixed: true
          output-format: sarif

      - name: Upload Grype results to GitHub Security
        if: steps.artifact.outputs.found == 'true'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.grype.outputs.sarif }}
          category: 'grype-${{ matrix.platform }}'