node_docker_build.yml

name: "Catalyst Node - Docker build and push"

on:
  workflow_dispatch:
  push:
    branches: [master]
    tags:
      - "v*"
    paths:
      - "common/**"
      - "e2e_tests/**"
      - "pacaya/**"
      - "permissionless/**"
      - "node/**"
      - "shasta/**"
      - "urc/**"

env:
  DOCKER_PUBLIC_REGISTRY: docker.io
  DOCKER_PUBLIC_REPOSITORY: nethermind/catalyst-node
  DOCKER_REGISTRY: nethermind.jfrog.io
  DOCKER_REPOSITORY_STAGING: core-oci-local-staging/catalyst-node
  MASTER_BRANCH: refs/heads/master

jobs:
  build:
    name: Build per-arch image
    runs-on: ${{ matrix.os }}
    if: github.repository == 'NethermindEth/Catalyst'
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            platform: linux/amd64
            short: amd64
          - os: ubuntu-24.04-arm
            platform: linux/arm64
            short: arm64

    outputs:
      digest-amd64: ${{ steps.digest.outputs.amd64 }}
      digest-arm64: ${{ steps.digest.outputs.arm64 }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to JFrog Artifactory
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ secrets.ARTIFACTORY_CORE_USERNAME }}
          password: ${{ secrets.ARTIFACTORY_CORE_TOKEN_DEVELOPER }}

      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          platforms: ${{ matrix.platform }}
          push: true
          build-args: |
            BLST_PORTABLE=1
          outputs: type=image,name=${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY_STAGING }},push-by-digest=true,name-canonical=true

      - name: Set digest output
        id: digest
        run: |
          echo "${{ matrix.short }}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT

  merge:
    name: Merge and push multi-arch manifest
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Login to JFrog Artifactory
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ secrets.ARTIFACTORY_CORE_USERNAME }}
          password: ${{ secrets.ARTIFACTORY_CORE_TOKEN_DEVELOPER }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Calculate SHA tag
        id: sha
        run: |
          SHORT_SHA="${{ github.sha }}"
          SHORT_SHA=${SHORT_SHA:0:7}
          echo "tag=sha-${SHORT_SHA}" >> $GITHUB_OUTPUT
          echo "short=${SHORT_SHA}" >> $GITHUB_OUTPUT

      - name: Determine tags and event type
        id: tags
        run: |
          REF="${{ github.ref }}"
          SHA_TAG="sha-${{ steps.sha.outputs.short }}"
          SOURCE_PROMOTE_TAG="${{ steps.sha.outputs.tag }}"
          IS_MASTER=false
          IS_TAG=false
          VERSION_TAG=""
          PROMOTE_TAGS="$SHA_TAG"

          if [[ "$REF" == refs/tags/* ]]; then
            IS_TAG=true
            VERSION_TAG=${REF#refs/tags/}
            echo "tag_list=type=raw,value=$VERSION_TAG" >> $GITHUB_OUTPUT
            PROMOTE_TAGS="$SHA_TAG $VERSION_TAG"
          elif [[ "$REF" == ${{ env.MASTER_BRANCH }} ]]; then
            IS_MASTER=true
            echo "tag_list=type=raw,value=latest" >> $GITHUB_OUTPUT
            PROMOTE_TAGS="$SHA_TAG latest"
          else
            echo "tag_list=type=sha,value=${{ github.sha }}" >> $GITHUB_OUTPUT
          fi

          # Staging gets the SHA tag plus whatever the conditional ref produced.
          STAGING_TAGS="$PROMOTE_TAGS"

          echo "is_master=$IS_MASTER" >> $GITHUB_OUTPUT
          echo "is_tag=$IS_TAG" >> $GITHUB_OUTPUT
          echo "version_tag=$VERSION_TAG" >> $GITHUB_OUTPUT
          echo "source_promote_tag=$SOURCE_PROMOTE_TAG" >> $GITHUB_OUTPUT
          echo "promote_tags=$PROMOTE_TAGS" >> $GITHUB_OUTPUT
          echo "staging_tags=$STAGING_TAGS" >> $GITHUB_OUTPUT
          echo "PROMOTE_TAGS=$PROMOTE_TAGS" >> $GITHUB_ENV

      - name: Generate Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY_STAGING }}
          tags: ${{ steps.tags.outputs.tag_list }}

      - name: Create and push manifest list
        run: |
          # Filter out "latest" tag if not on master branch
          if [[ "${{ steps.tags.outputs.is_master }}" != "true" ]]; then
            FILTERED_TAGS=$(jq -cr '.tags | map(select(. | endswith(":latest") | not)) | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON")
          else
            FILTERED_TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON")
          fi

          if [ -n "$FILTERED_TAGS" ]; then
            docker buildx imagetools create \
              $FILTERED_TAGS \
              ${{ needs.build.outputs.digest-amd64 }} \
              ${{ needs.build.outputs.digest-arm64 }}
          fi

      - name: Tag with commit SHA
        run: |
          docker buildx imagetools create \
            -t ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY_STAGING }}:${{ steps.sha.outputs.tag }} \
            ${{ needs.build.outputs.digest-amd64 }} \
            ${{ needs.build.outputs.digest-arm64 }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_PUBLIC_REGISTRY }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Promote to Docker Hub Production
        id: promote
        env:
          SOURCE_TAG: ${{ steps.tags.outputs.source_promote_tag }}
        run: |
          set -euo pipefail
          source_image="${DOCKER_REGISTRY}/${DOCKER_REPOSITORY_STAGING}:${SOURCE_TAG}"
          echo "Tags to promote: $PROMOTE_TAGS"
          : > subject.checksums.txt
          for tag in $PROMOTE_TAGS; do
            target_image="${DOCKER_PUBLIC_REGISTRY}/${DOCKER_PUBLIC_REPOSITORY}:${tag}"
            echo ""
            echo "=== Promoting ${source_image} -> ${target_image} ==="

            # Copy the full multi-arch manifest list registry-to-registry.
            # A plain docker pull/tag/push would flatten the index to the
            # runner's architecture (amd64) and silently drop the arm64 image.
            docker buildx imagetools create -t "${target_image}" "${source_image}"

            # Record the promoted manifest digest for provenance/attestation.
            DIGEST=$(docker buildx imagetools inspect "${target_image}" --raw | sha256sum | cut -d' ' -f1)
            echo "${DIGEST}  ${target_image}" >> subject.checksums.txt
            echo "✓ Promoted ${tag} (sha256:${DIGEST})"
          done
          echo ""
          echo "All tags promoted successfully"
          echo "--- subject.checksums.txt ---"
          cat subject.checksums.txt

      - name: Summary
        run: |
          STAGING_REPO="${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY_STAGING }}"
          PROD_REPO="${{ env.DOCKER_PUBLIC_REGISTRY }}/${{ env.DOCKER_PUBLIC_REPOSITORY }}"
          STAGING_TAGS="${{ steps.tags.outputs.staging_tags }}"
          PROMOTE_TAGS_OUT="${{ steps.tags.outputs.promote_tags }}"

          echo "## Catalyst Node Docker build Completed" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Commit**: \`${{ github.sha }}\` (\`${{ steps.sha.outputs.short }}\`)" >> $GITHUB_STEP_SUMMARY
          echo "- **Platforms**: linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          echo "### Staging — \`${STAGING_REPO}\`" >> $GITHUB_STEP_SUMMARY
          if [ -n "$STAGING_TAGS" ]; then
            for tag in $STAGING_TAGS; do
              echo "- \`${STAGING_REPO}:${tag}\`" >> $GITHUB_STEP_SUMMARY
            done
          else
            echo "- _No tags pushed_" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY

          echo "### Production — \`${PROD_REPO}\`" >> $GITHUB_STEP_SUMMARY
          if [ -n "$PROMOTE_TAGS_OUT" ]; then
            for tag in $PROMOTE_TAGS_OUT; do
              echo "- \`${PROD_REPO}:${tag}\`" >> $GITHUB_STEP_SUMMARY
            done
          else
            echo "- _No tags promoted_" >> $GITHUB_STEP_SUMMARY
          fi