name: frontend

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

on:
  workflow_dispatch:
  push:
    branches:
      - 'master'
      - 'v[0-9]+.[0-9]+'
    tags:
      - 'dockerfile/*'
  pull_request:
    paths-ignore:
      - 'README.md'
      - 'docs/**'
      - 'frontend/dockerfile/docs/**'

env:
  GO_VERSION: "1.26"
  SETUP_BUILDX_VERSION: "edge"
  SETUP_BUILDKIT_TAG: "moby/buildkit:latest"
  SCOUT_VERSION: "1.20.2"
  IMAGE_NAME: "docker/dockerfile-upstream"

jobs:
  test:
    uses: ./.github/workflows/.test.yml
    with:
      cache_scope: frontend-integration-tests
      pkgs: ./frontend/dockerfile
      kinds: |
        integration
        dockerfile
      codecov_flags: dockerfile-frontend
    secrets:
      codecov_token: ${{ secrets.CODECOV_TOKEN }}

  prepare:
    runs-on: ubuntu-24.04
    outputs:
      includes: ${{ steps.set.outputs.includes }}
      tag: ${{ steps.set.outputs.tag }}
    steps:
      -
        name: Set outputs
        id: set
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_REF: ${{ github.ref }}
          INPUT_CHANNELS: |
            mainline
            labs
          INPUT_IMAGE-NAME: ${{ env.IMAGE_NAME }}
        with:
          script: |
            const ref = core.getInput('ref');
            const channels = core.getMultilineInput('channels');
            const imageName = core.getInput('image-name');
            
            function getTags(channel) {
              let tagSuffix = '';
              if (channel !== 'mainline') {
                tagSuffix = `-${channel}`;
              }
              let tagLatest = '';
              let tagVersion = '';
              if (ref.startsWith('refs/tags/dockerfile/')) {
                const version = ref.replace('refs/tags/dockerfile/', '').replace(new RegExp(`-${channel}$`), '');
                if (/^[0-9]+\.[0-9]+\.[0-9]+$/.test(version)) {
                  tagLatest = channel === 'mainline' ? 'latest' : channel;
                }
                tagVersion = version;
              }
              return { tagSuffix, tagLatest, tagVersion };
            }
            
            const matrix = [];
            if (ref.startsWith('refs/tags/dockerfile/')) {
              const version = ref.replace('refs/tags/dockerfile/', '');
              for (const channel of channels) {
                if (version.endsWith(`-${channel}`)) {
                  const { tagSuffix, tagLatest, tagVersion } = getTags(channel);
                  matrix.push({
                    channel: channel,
                    imageName: imageName,
                    tagSuffix: tagSuffix,
                    tagLatest: tagLatest,
                    tagVersion: tagVersion
                  });
                  break;
                }
              }
              if (matrix.length === 0) {
                // default to mainline if no channel suffix
                const { tagSuffix, tagLatest, tagVersion } = getTags('mainline');
                matrix.push({
                  channel: 'mainline',
                  imageName: imageName,
                  tagSuffix: tagSuffix,
                  tagLatest: tagLatest,
                  tagVersion: tagVersion
                });
              }
              core.setOutput('tag', ref.replace('refs/tags/', ''));
            } else {
              for (const channel of channels) {
                const { tagSuffix, tagLatest, tagVersion } = getTags(channel);
                matrix.push({
                  channel: channel,
                  imageName: imageName,
                  tagSuffix: tagSuffix,
                  tagLatest: tagLatest,
                  tagVersion: tagVersion
                });
              }
            }
            
            core.info(JSON.stringify(matrix, null, 2));
            core.setOutput('includes', JSON.stringify(matrix));

  image:
    uses: docker/github-builder/.github/workflows/bake.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0
    needs:
      - prepare
      - test
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare.outputs.includes) }}
    permissions:
      contents: read # same as global permission
      id-token: write # for signing attestations, cache entries and logging in to Docker Hub with GitHub OIDC
    with:
      runner: ubuntu-24.04
      target: frontend-image-cross
      cache: true
      cache-scope: frontend-${{ matrix.channel }}
      output: image
      push: ${{ github.repository == 'moby/buildkit' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/dockerfile/')) }}
      sbom: true
      vars: |
        FRONTEND_CHANNEL=${{ matrix.channel }}
      set-meta-annotations: true
      meta-images: |
        ${{ matrix.imageName }}
      # versioning strategy
      ## push tag dockerfile/1.17.0
      ### docker/dockerfile-upstream:1.17.0
      ### docker/dockerfile-upstream:1.17
      ### docker/dockerfile-upstream:1
      ### docker/dockerfile-upstream:latest
      ## push tag dockerfile/1.17.0-labs
      ### docker/dockerfile-upstream:1.17.0-labs
      ### docker/dockerfile-upstream:1.17-labs
      ### docker/dockerfile-upstream:1-labs
      ### docker/dockerfile-upstream:labs
      ## push prerelease tag dockerfile/1.17.0-rc1
      ### docker/dockerfile-upstream:1.17.0-rc1
      ## push prerelease tag dockerfile/1.17.0-rc1-labs
      ### docker/dockerfile-upstream:1.17.0-rc1-labs
      ## push on master
      ### docker/dockerfile-upstream:master
      ### docker/dockerfile-upstream:master-labs
      meta-tags: |
        type=ref,event=branch,suffix=${{ matrix.tagSuffix }}
        type=ref,event=pr,suffix=${{ matrix.tagSuffix }}
        type=semver,pattern={{version}},value=${{ matrix.tagVersion }},suffix=${{ matrix.tagSuffix }}
        type=semver,pattern={{major}}.{{minor}},value=${{ matrix.tagVersion }},suffix=${{ matrix.tagSuffix }}
        type=semver,pattern={{major}},value=${{ matrix.tagVersion }},suffix=${{ matrix.tagSuffix }}
        type=raw,value=${{ matrix.tagLatest }}
      meta-flavor: |
        latest=false
      meta-annotations: |
        org.opencontainers.image.title=Dockerfile Frontend
        org.opencontainers.image.vendor=Moby
      meta-bake-target: frontend-meta-helper
      registry-identities: |
        - type: dockerhub
          registry: docker.io
          username: docker
          connection_id: ${{ vars.DOCKERFILE_OIDC_CONNECTIONID }}

  scout:
    runs-on: ubuntu-24.04
    if: ${{ github.repository == 'moby/buildkit' && github.ref == 'refs/heads/master' }}
    permissions:
      contents: read # same as global permission
      security-events: write # required to write sarif report
    needs:
      - image
    strategy:
      fail-fast: false
      matrix:
        tag:
          - master
          - master-labs
    steps:
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        # FIXME: switch to OIDC once Scout supports it
        name: Login to DockerHub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Scout
        id: scout
        uses: crazy-max/.github/.github/actions/docker-scout@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
        with:
          version: ${{ env.SCOUT_VERSION }}
          format: sarif
          image: registry://${{ env.IMAGE_NAME }}:${{ matrix.tag }}
      -
        name: Result output
        run: |
          jq . ${{ steps.scout.outputs.result-file }}
      -
        name: Upload SARIF report
        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          sarif_file: ${{ steps.scout.outputs.result-file }}

  release:
    runs-on: ubuntu-24.04
    if: startsWith(github.ref, 'refs/tags/dockerfile')
    permissions:
      # required to create GitHub release
      contents: write
    needs:
      - prepare
      - test
      - image
    steps:
      -
        name: GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          draft: true
          name: ${{ needs.prepare.outputs.tag }}