ci.yml

name: frontend-ci

on:
  pull_request:
    branches: [dev, main]
  push:
    branches: [dev]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: frontend-ci-${{ github.workflow }}-${{ github.ref }}
  # PR 피드백은 최신 실행만 남기되, dev publish는 commit별로 순차 완료한다.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  check:
    name: frontend-ci / check
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Guard manual dispatch at current dev HEAD
        if: ${{ github.event_name == 'workflow_dispatch' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          test "$GITHUB_REF" = refs/heads/dev
          dev_sha=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/dev" --jq '.object.sha')
          [[ "$dev_sha" =~ ^[0-9a-f]{40}$ ]]
          test "$dev_sha" = "$GITHUB_SHA"

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'

      - name: Install CI contract dependencies
        run: python3 -m pip install --require-hashes -r .github/requirements-ci.txt

      - name: Test frontend CI contract
        run: python3 -m unittest -v tests.test_frontend_ci_contract

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Build frontend with dev repository secrets
        if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/dev' }}
        env:
          VITE_API_BASE_URL: ${{ secrets.VITE_API_BASE_URL }}
          VITE_KAKAO_REST_KEY: ${{ secrets.VITE_KAKAO_REST_KEY }}
          VITE_KAKAO_JS_KEY: ${{ secrets.VITE_KAKAO_JS_KEY }}
        run: |
          set -euo pipefail
          : "${VITE_API_BASE_URL:?VITE_API_BASE_URL must be a non-empty build-time value}"
          : "${VITE_KAKAO_REST_KEY:?VITE_KAKAO_REST_KEY must be a non-empty build-time value}"
          : "${VITE_KAKAO_JS_KEY:?VITE_KAKAO_JS_KEY must be a non-empty build-time value}"
          npm run build
          if ! grep --recursive --fixed-strings --quiet -- "$VITE_API_BASE_URL" dist; then
            echo "::error::Built dist does not contain the configured API base URL"
            exit 1
          fi

      - name: Build frontend with pull request placeholders
        if: ${{ github.event_name == 'pull_request' }}
        env:
          VITE_API_BASE_URL: /api/core/v1
          VITE_KAKAO_REST_KEY: ci-public-rest-key
          VITE_KAKAO_JS_KEY: ci-public-js-key
        run: |
          set -euo pipefail
          : "${VITE_API_BASE_URL:?VITE_API_BASE_URL must be a non-empty build-time value}"
          : "${VITE_KAKAO_REST_KEY:?VITE_KAKAO_REST_KEY must be a non-empty build-time value}"
          : "${VITE_KAKAO_JS_KEY:?VITE_KAKAO_JS_KEY must be a non-empty build-time value}"
          npm run build
          if ! grep --recursive --fixed-strings --quiet -- "$VITE_API_BASE_URL" dist; then
            echo "::error::Built dist does not contain the configured API base URL"
            exit 1
          fi

      - name: Test frontend
        run: npm run test

      - name: Create immutable frontend image recipe
        run: |
          set -euo pipefail
          mkdir -p .ci-image/context
          cp -R dist .ci-image/context/dist
          cp infra/frontend-image/Dockerfile .ci-image/context/Dockerfile
          cp infra/frontend-image/nginx.conf .ci-image/context/nginx.conf

      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Validate frontend container image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .ci-image/context
          file: .ci-image/context/Dockerfile
          platforms: linux/amd64
          push: false
          load: true
          tags: pinlog-front:ci-${{ github.sha }}

      - name: Smoke test frontend container security contract
        run: |
          set -euo pipefail
          image="pinlog-front:ci-${GITHUB_SHA}"
          cid=$(docker run --detach \
            --user 101:101 \
            --cap-drop ALL \
            --security-opt no-new-privileges:true \
            --read-only \
            --tmpfs /tmp:rw,noexec,nosuid,size=16m \
            --publish 127.0.0.1::8080 \
            "$image")
          cleanup() {
            docker logs "$cid" || true
            docker rm --force "$cid" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          address=$(docker port "$cid" 8080/tcp)
          base_url="http://${address}"
          for attempt in $(seq 1 30); do
            if curl --fail --silent --show-error "$base_url/healthz" > /tmp/healthz; then
              break
            fi
            if [ "$attempt" -eq 30 ]; then
              echo "::error::Frontend container did not become healthy"
              exit 1
            fi
            sleep 1
          done

          test "$(cat /tmp/healthz)" = "ok"
          curl --fail --silent --show-error "$base_url/" > /tmp/root.html
          curl --fail --silent --show-error "$base_url/spa-route" > /tmp/spa.html
          cmp /tmp/root.html /tmp/spa.html
          test "$(curl --silent --output /dev/null --write-out '%{http_code}' \
            "$base_url/api/core/v1/healthz")" = "404"

      - name: Upload validated frontend image context
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: frontend-image-${{ github.sha }}
          path: .ci-image/context/
          if-no-files-found: error
          include-hidden-files: true
          retention-days: 1

  image-publish:
    name: frontend-image / publish
    if: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/dev' }}
    needs: check
    environment: dev
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Download validated frontend image context
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: frontend-image-${{ github.sha }}
          path: .ci-image/context

      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Log in to GHCR
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve run-bound immutable image identity
        id: identity
        shell: bash
        env:
          VITE_API_BASE_URL: ${{ secrets.VITE_API_BASE_URL }}
          VITE_KAKAO_REST_KEY: ${{ secrets.VITE_KAKAO_REST_KEY }}
          VITE_KAKAO_JS_KEY: ${{ secrets.VITE_KAKAO_JS_KEY }}
          DEPLOY_CANARY_REV: ${{ secrets.DEPLOY_CANARY_REV }}
        run: |
          set -euo pipefail
          [[ "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]]
          [[ "$GITHUB_RUN_ID" =~ ^[1-9][0-9]*$ ]]
          [[ "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
          : "${VITE_API_BASE_URL:?missing variable}"
          : "${VITE_KAKAO_REST_KEY:?missing variable}"
          : "${VITE_KAKAO_JS_KEY:?missing variable}"
          : "${DEPLOY_CANARY_REV:?missing variable}"
          [[ "$DEPLOY_CANARY_REV" =~ ^[A-Za-z0-9._-]+$ ]]
          export VITE_API_BASE_URL VITE_KAKAO_REST_KEY VITE_KAKAO_JS_KEY DEPLOY_CANARY_REV
          fingerprint=$(python3 - <<'PY'
          import hashlib, os, sys
          names = ("VITE_API_BASE_URL", "VITE_KAKAO_REST_KEY", "VITE_KAKAO_JS_KEY", "DEPLOY_CANARY_REV")
          out = bytearray()
          for name in names:
              key = name.encode()
              value = os.environ[name].encode()
              out += len(key).to_bytes(4, "big") + key + len(value).to_bytes(8, "big") + value
          sys.stdout.write(hashlib.sha256(out).hexdigest())
          PY
          )
          test "$(printf '%s' "$fingerprint" | sha256sum | cut -d' ' -f1 | wc -c)" -eq 65
          [[ "$fingerprint" =~ ^[0-9a-f]{64}$ ]]
          config_id=${fingerprint:0:20}
          IMAGE_TAG="${GITHUB_SHA}-cfg-${config_id}-run-${GITHUB_RUN_ID}-a${GITHUB_RUN_ATTEMPT}"
          [[ "$IMAGE_TAG" =~ ^[0-9a-f]{40}-cfg-[0-9a-f]{20}-run-[1-9][0-9]*-a[1-9][0-9]*$ ]]
          test "${#IMAGE_TAG}" -le 128
          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
          echo "config_fingerprint=$config_id" >> "$GITHUB_OUTPUT"

      - name: Build and publish run-bound immutable frontend image
        id: publish
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .ci-image/context
          file: .ci-image/context/Dockerfile
          platforms: linux/amd64
          push: true
          tags: ghcr.io/team-pinlog/front:${{ steps.identity.outputs.image_tag }}
          labels: org.opencontainers.image.revision=${{ github.sha }}

      - name: Verify immutable image and write provenance
        env:
          IMAGE_TAG: ${{ steps.identity.outputs.image_tag }}
          CONFIG_FINGERPRINT: ${{ steps.identity.outputs.config_fingerprint }}
          BUILT_DIGEST: ${{ steps.publish.outputs.digest }}

        run: |
          set -euo pipefail
          IMAGE_DIGEST=$BUILT_DIGEST

          [[ "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
          inspection=$(docker buildx imagetools inspect "ghcr.io/team-pinlog/front:${IMAGE_TAG}")
          RESOLVED_DIGEST=$(printf '%s\n' "$inspection" | sed -nE 's/^Digest:[[:space:]]+(sha256:[0-9a-f]{64})$/\1/p' | head -n 1)
          [[ "$RESOLVED_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
          test "$RESOLVED_DIGEST" = "$IMAGE_DIGEST"
          docker buildx imagetools inspect "ghcr.io/team-pinlog/front@${IMAGE_DIGEST}" >/dev/null
          mkdir -p .ci-provenance
          jq -n --argjson schema_version 1 --arg source_repository "$GITHUB_REPOSITORY" --arg source_sha "$GITHUB_SHA" \
            --arg source_ref dev --arg image_repository ghcr.io/team-pinlog/front --arg image_tag "$IMAGE_TAG" \
            --arg image_digest "$IMAGE_DIGEST" --arg config_fingerprint "$CONFIG_FINGERPRINT" --argjson workflow_run_id "$GITHUB_RUN_ID" --argjson workflow_run_attempt "$GITHUB_RUN_ATTEMPT" \
            '{schema_version:$schema_version,source_repository:$source_repository,source_sha:$source_sha,source_ref:$source_ref,image_repository:$image_repository,image_tag:$image_tag,image_digest:$image_digest,config_fingerprint:$config_fingerprint,workflow_run_id:$workflow_run_id,workflow_run_attempt:$workflow_run_attempt}' \
            > .ci-provenance/frontend-image-provenance.json
          python3 tools/validate_frontend_provenance.py .ci-provenance/frontend-image-provenance.json
          echo "Verified image: $IMAGE_TAG@$IMAGE_DIGEST"

      - name: Upload run-bound image provenance
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: frontend-image-provenance
          path: .ci-provenance/frontend-image-provenance.json
          if-no-files-found: error
          retention-days: 7

      - name: Request trusted Infra image promotion
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.PINLOG_INFRA_IMAGE_PR_TOKEN }}
        run: |
          set -euo pipefail
          test -n "$GH_TOKEN"
          gh workflow run frontend-image-update.yaml \
            --repo Team-PinLog/infra \
            --ref main