phpfpm.yml

name: Build, Test and Push Docker Images

on:
  workflow_dispatch:
    inputs:
      build_phpfpm:
        description: 'Build PHP-FPM images'
        required: false
        type: boolean
        default: true
      build_nginx:
        description: 'Build Nginx image'
        required: false
        type: boolean
        default: true
  schedule:
    - cron: '0 2 */3 * *'  # Runs every 3 days at 02:00 UTC
  push:
    branches:
      - main
    paths:
      - '.env'
      - 'src/**'
      - 'support/**'
      - '.hadolint.yaml'
      - '.github/workflows/phpfpm.yml'
      - '!**/*.md'
  pull_request:
    branches:
      - main
      - develop
    paths:
      - '.env'
      - 'src/**'
      - 'support/**'
      - '.hadolint.yaml'
      - '.github/workflows/phpfpm.yml'
      - '!**/*.md'

concurrency:
  group: ${{ github.ref }}-build
  cancel-in-progress: true

jobs:
  keepalive:
    # Resets GitHub's 60-day inactivity timer so the scheduled rebuild
    # never falls into disabled_inactivity again (this repo was dead 2026-05-31..06-12).
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    permissions:
      actions: write
    steps:
      - name: Re-enable workflow (keepalive)
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh api -X PUT repos/${{ github.repository }}/actions/workflows/phpfpm.yml/enable

  # =============================================================================
  # Lint — both Dockerfiles, single required context "hadolint"
  # =============================================================================
  hadolint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out the repository
        uses: actions/checkout@v6

      - name: Lint php Dockerfile (hadolint)
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: src/php/Dockerfile
          config: .hadolint.yaml

      - name: Lint nginx Dockerfile (hadolint)
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: src/nginx/Dockerfile
          config: .hadolint.yaml

  # =============================================================================
  # PHP-FPM Images (Matrix Build)
  # =============================================================================
  build-phpfpm:
    if: ${{ github.event_name != 'workflow_dispatch' || inputs.build_phpfpm }}
    runs-on: ubuntu-latest

    strategy:
      matrix:
        php_version: ["8.2", "8.3", "8.4"]
      fail-fast: false

    permissions:
      contents: read
      packages: write

    steps:
      - name: Check out the repository
        uses: actions/checkout@v6

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USER_NAME }}
          password: ${{ secrets.DOCKER_PAT }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          install: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      # Smoke tests boot the freshly built image. The runner is amd64, so booting
      # an arm64 image means QEMU emulation — which is both very slow and prone to
      # hanging indefinitely (no timeout) on the buildx --load step. We therefore
      # smoke-test only on the native runner arch; the multi-arch *build* (incl.
      # arm64 compile correctness) is still validated by the buildx push step below.
      - name: Run smoke tests (native amd64 on test image)
        run: make test-all PHP_VERSION=${{ matrix.php_version }} TEST_PLATFORMS=amd64

      # Push-Guard: PRs build & smoke-test above but never publish; only
      # merge/schedule/dispatch push the moving + immutable date tags.
      - name: Build and push PHP-FPM ${{ matrix.php_version }}
        if: github.event_name != 'pull_request'
        env:
          DOCKER_HUB: ${{ secrets.DOCKER_USER_NAME }}
        run: |
          make phpfpm-push \
            PHP_VERSION=${{ matrix.php_version }} \
            DOCKER_HUB=${DOCKER_HUB}

  # =============================================================================
  # Nginx Image
  # =============================================================================
  build-nginx:
    if: ${{ github.event_name != 'workflow_dispatch' || inputs.build_nginx }}
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    steps:
      - name: Check out the repository
        uses: actions/checkout@v6

      - name: Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USER_NAME }}
          password: ${{ secrets.DOCKER_PAT }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          install: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      # Native arch only — see the rationale on the php-fpm smoke step above.
      - name: Run smoke test (nginx config, native amd64)
        run: make nginx-test TEST_PLATFORMS=amd64

      # Push-Guard: PRs build & smoke-test above but never publish.
      - name: Build and push Nginx
        if: github.event_name != 'pull_request'
        env:
          DOCKER_HUB: ${{ secrets.DOCKER_USER_NAME }}
        run: make nginx-push DOCKER_HUB=${DOCKER_HUB}

  # =============================================================================
  # Trivy — non-blocking CVE visibility on the freshly published images
  # (base-image CVEs are not self-fixable, so this reports instead of failing).
  # continue-on-error keeps the run green even if Trivy itself errors.
  # =============================================================================
  trivy-report:
    if: github.event_name != 'pull_request'
    needs: [build-phpfpm, build-nginx]
    runs-on: ubuntu-latest
    continue-on-error: true
    permissions:
      contents: read
    strategy:
      matrix:
        image:
          - headgent/phpfpm:8.2
          - headgent/phpfpm:8.3
          - headgent/phpfpm:8.4
          - headgent/nginx:1.28
      fail-fast: false
    steps:
      - name: Scan image for HIGH/CRITICAL CVEs
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: ${{ matrix.image }}
          format: table
          severity: HIGH,CRITICAL
          exit-code: '0'
          output: trivy-report.txt

      - name: Publish report to job summary
        run: |
          {
            echo "## Trivy CVE report — ${{ matrix.image }} (HIGH/CRITICAL)";
            echo '```';
            cat trivy-report.txt;
            echo '```';
          } >> "$GITHUB_STEP_SUMMARY"