obsidian-livesync/.github/workflows/cli-docker.yml

# Build and push the CLI Docker image to GitHub Container Registry (GHCR).#
# Image tag format: <manifest-version>-<unix-epoch>-cli
# Example: 0.25.56-1743500000-cli
#
# The image is also tagged 'latest' for convenience.
# Image name: ghcr.io/<owner>/livesync-cli
name: Build and Push CLI Docker Image

on:
    push:
        branches:
            - main
        tags:
            - "*.*.*-cli"
    workflow_dispatch:
        inputs:
            dry_run:
                description: Build only (do not push image to GHCR)
                required: false
                type: boolean
                default: true
            force:
                description: Continue to build/push even if CLI E2E fails (workflow_dispatch only)
                required: false
                type: boolean
                default: false

jobs:
    build-and-push:
        runs-on: ubuntu-latest
        timeout-minutes: 90
        permissions:
            contents: read
            packages: write

        steps:
            - name: Checkout
              uses: actions/checkout@v4
              with:
                  submodules: recursive

            - name: Derive image tag
              id: meta
              run: |
                  VERSION=$(jq -r '.version' manifest.json)
                  SHORT_SHA=$(git rev-parse --short HEAD)
                  IMAGE="ghcr.io/${{ github.repository_owner }}/livesync-cli"
                  
                  # Build tag list based on the event and git ref
                  TAGS=""
                  if [[ "${{ github.ref }}" == refs/tags/* ]]; then
                      # Stable release builds
                      TAGS="${IMAGE}:${VERSION}-cli,${IMAGE}:latest,${IMAGE}:${VERSION}-sha-${SHORT_SHA}-cli"
                  elif [[ "${{ github.ref }}" == refs/heads/main ]]; then
                      # Bleeding-edge / nightly builds
                      TAGS="${IMAGE}:edge,${IMAGE}:${VERSION}-dev-sha-${SHORT_SHA}-cli"
                  else
                      # Other branches / manual run fallback
                      TAGS="${IMAGE}:${VERSION}-dev-sha-${SHORT_SHA}-cli"
                  fi
                  
                  # Determine if the image should be pushed
                  PUSH="true"
                  if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
                      if [[ "${{ inputs.dry_run }}" == "true" ]]; then
                          PUSH="false"
                      fi
                  fi
                  
                  echo "tags=${TAGS}" >> $GITHUB_OUTPUT
                  echo "push=${PUSH}" >> $GITHUB_OUTPUT

            - name: Log in to GitHub Container Registry
              uses: docker/login-action@v3
              with:
                  registry: ghcr.io
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: "24.x"
                  cache: "npm"

            - name: Install dependencies
              run: npm ci

            - name: Run CLI E2E (docker)
              id: e2e
              continue-on-error: ${{ github.event_name == 'workflow_dispatch' && inputs.force }}
              working-directory: src/apps/cli
              env:
                  CI: true
              run: npm run test:e2e:docker:all

            - name: Stop test containers (safety net)
              if: always()
              working-directory: src/apps/cli
              run: |
                  # Keep this as a safety net for future suites/steps that may leave containers running.
                  bash ./util/couchdb-stop.sh >/dev/null 2>&1 || true
                  bash ./util/minio-stop.sh >/dev/null 2>&1 || true
                  bash ./util/p2p-stop.sh >/dev/null 2>&1 || true

            - name: Build and push
              if: ${{ steps.e2e.outcome == 'success' || (github.event_name == 'workflow_dispatch' && inputs.force) }}
              uses: docker/build-push-action@v6
              with:
                  context: .
                  file: src/apps/cli/Dockerfile
                  push: ${{ steps.meta.outputs.push }}
                  tags: ${{ steps.meta.outputs.tags }}
                  cache-from: type=gha
                  cache-to: type=gha,mode=max