Harden the meshcentral chart

.dockerignore

@@ -12,4 +12,5 @@ docker/
 *.njsproj
 *.md
 examples
-tests
+tests
+charts/

.github/workflows/changes.yaml

@@ -0,0 +1,111 @@
+name: Detect Changes
+
+on:
+  workflow_call:
+    outputs:
+      images_matrix:
+        description: "Images matrix configuration for all components"
+        value: ${{ jobs.collect.outputs.images_matrix }}
+      changes:
+        description: "JSON object mapping each component key to true/false"
+        value: ${{ jobs.collect.outputs.changes }}
+      timestamp:
+        value: ${{ jobs.collect.outputs.timestamp }}
+      commit_sha:
+        value: ${{ jobs.collect.outputs.commit_sha }}
+      test_commit_sha:
+        value: ${{ jobs.collect.outputs.test_commit_sha }}
+
+jobs:
+  collect:
+    name: Changes and Matrix
+    runs-on: ubuntu-latest
+    outputs:
+      images_matrix: ${{ steps.define.outputs.images_matrix }}
+      changes: ${{ steps.changes.outputs.changes }}
+      timestamp: ${{ steps.setup_env.outputs.timestamp }}
+      commit_sha: ${{ steps.setup_env.outputs.commit_sha }}
+      test_commit_sha: ${{ steps.setup_env.outputs.test_commit_sha }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Set up environment
+        id: setup_env
+        run: |
+          set -euo pipefail
+          echo "timestamp=$(date +%s)" >> "$GITHUB_OUTPUT"
+          echo "commit_sha=${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
+          echo "test_commit_sha=test-${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
+
+      - name: Define components
+        id: define
+        run: |
+          set -euo pipefail
+
+          IMAGES='[
+            {
+              "name": "meshcentral",
+              "paths": [
+                "./docker/**",
+                "./.dockerignore",
+                "./package.json",
+                "./package-lock.json",
+                "./*.js",
+                "./plugins/**",
+                "./agents/**",
+                "./emails/**",
+                "./translate/**",
+                "./views/**",
+                "./public/**"
+              ]
+            }
+          ]'
+
+          ADDONS='{
+            "helm": ["./charts/**"]
+          }'
+
+          images_matrix=$(jq -c '[ .[] | {
+            name,
+            path:    (.path    // "./docker"),
+            context: (.context // ".")
+          } ]' <<< "$IMAGES")
+
+          filters=$(jq -nc \
+            --argjson images "$IMAGES" \
+            --argjson addons "$ADDONS" '
+            ( [ $images[] | { key: .name, value: (.paths // ["./\(.name)/**"]) } ]
+              | from_entries )
+            + $addons
+          ')
+
+          keys=$(jq -nc --argjson f "$filters" '$f | keys')
+
+          # fail fast if the matrix or filters came out empty
+          [ "$(jq 'length' <<< "$images_matrix")" -gt 0 ] || { echo "images_matrix is empty" >&2; exit 1; }
+          [ "$(jq 'length' <<< "$keys")"          -gt 0 ] || { echo "no change filters"       >&2; exit 1; }
+
+          {
+            echo "images_matrix=$images_matrix"
+            echo "filters=$filters"
+            echo "keys=$keys"
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: dorny/paths-filter@v4.0.2
+        id: filter
+        with:
+          filters: ${{ steps.define.outputs.filters }}
+
+      - name: Build changes map
+        id: changes
+        env:
+          CHANGED: ${{ steps.filter.outputs.changes || '[]' }}
+          KEYS: ${{ steps.define.outputs.keys }}
+        run: |
+          set -euo pipefail
+          changes=$(jq -nc --argjson changed "$CHANGED" --argjson keys "$KEYS" '
+            reduce $keys[] as $k ({}; .[$k] = ((($changed | index($k)) != null) | tostring))
+          ')
+          echo "changes=$changes" >> "$GITHUB_OUTPUT"

.github/workflows/release.yml

@@ -41,29 +41,37 @@ jobs:
 
   changes:
     name: Detect Changes
-    uses: ./.github/workflows/changes.yml
+    uses: ./.github/workflows/changes.yaml
     if: |
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'push'
 
 
   build:
-    name: "Build meshcentral"
+    name: "Build: ${{ matrix.name }}"
     needs: [version, changes]
     runs-on: ubuntu-latest
-    if: |
-      (github.event_name == 'push' && needs.changes.outputs.docker == 'true') ||
-      (github.event_name == 'workflow_dispatch' && needs.version.outputs.version != '')
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.changes.outputs.images_matrix) }}
     steps:
+      - name: Check if build should run
+        id: should_run
+        run: echo "run=${{ (github.event_name == 'workflow_dispatch' && needs.version.outputs.version != '') || (github.event_name == 'push' && fromJSON(needs.changes.outputs.changes || '{}')[matrix.name] == 'true') }}" >> "$GITHUB_OUTPUT"
+
       - name: Checkout
         uses: actions/checkout@v4
+        if: steps.should_run.outputs.run == 'true'
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
+        if: steps.should_run.outputs.run == 'true'
         with:
           node-version: "24.x"
 
       - name: Run translations
+        if: steps.should_run.outputs.run == 'true'
         working-directory: translate
         run: |
           node translate.js || true
@@ -73,24 +81,28 @@ jobs:
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
+        if: steps.should_run.outputs.run == 'true'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
+        if: steps.should_run.outputs.run == 'true'
         with:
           platforms: linux/amd64,linux/arm64
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        if: steps.should_run.outputs.run == 'true'
 
       - name: Generate metadata
         id: meta
         uses: docker/metadata-action@v5
+        if: steps.should_run.outputs.run == 'true'
         with:
-          images: ${{ env.REGISTRY }}/${{ env.ORGANISATION }}/${{ env.REPOSITORY }}/meshcentral
+          images: ${{ env.REGISTRY }}/${{ env.ORGANISATION }}/${{ env.REPOSITORY }}/${{ matrix.name }}
           tags: |
             type=ref,event=tag
             type=raw,value=latest,enable={{is_default_branch}}
@@ -103,9 +115,10 @@ jobs:
       - name: Build and push image
         id: docker_build
         uses: docker/build-push-action@v6
+        if: steps.should_run.outputs.run == 'true'
         with:
-          context: .
-          file: ./docker/Dockerfile
+          context: ${{ matrix.context }}
+          file: ${{ matrix.path }}/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: true
           provenance: false
@@ -118,7 +131,7 @@ jobs:
         uses: dataaxiom/ghcr-cleanup-action@v1
         continue-on-error: true
         with:
-          package: ${{ env.REPOSITORY }}/meshcentral
+          package: ${{ env.REPOSITORY }}/${{ matrix.name }}
           delete-ghost-images: true
           delete-tags: '.*'
           exclude-tags: '^(?:[0-9]+\.[0-9]+\.[0-9]+|latest|test-.*)$'
@@ -130,7 +143,7 @@ jobs:
     needs: [version, changes]
     runs-on: ubuntu-latest
     if: |
-      (github.event_name == 'push' && needs.changes.outputs.helm == 'true') ||
+      (github.event_name == 'push' && fromJSON(needs.changes.outputs.changes || '{}').helm == 'true') ||
       (github.event_name == 'workflow_dispatch' && needs.version.outputs.version != '')
     steps:
       - name: Checkout
@@ -153,7 +166,7 @@ jobs:
 
   release:
     name: "Create Release"
-    needs: [version, build, build_helm]
+    needs: [version, changes, build, build_helm]
     if: ${{ !failure() && !cancelled() }}
     runs-on: ubuntu-latest
     steps:
@@ -163,9 +176,11 @@ jobs:
       - name: Generate release header
         run: |
           VERSION="${{ needs.version.outputs.version }}"
+          IMAGES=$(echo '${{ needs.changes.outputs.images_matrix }}' | jq -r '.[] | "- `${{ env.REGISTRY }}/${{ github.repository }}/\(.name):'"${VERSION}"'`"')
+
           cat > RELEASE_HEADER.md <<EOF
           ## Images
-          - \`${{ env.REGISTRY }}/${{ github.repository }}/meshcentral:${VERSION}\`
+          ${IMAGES}
 
           ## Helm Chart
           - \`oci://${{ env.REGISTRY }}/${{ github.repository }}/helm-charts/meshcentral:${VERSION}\`

.github/workflows/test.yml

@@ -32,50 +32,60 @@ env:
 
 jobs:
   changes:
-    name: Changes
-    uses: ./.github/workflows/changes.yml
+    name: Detect Changes
+    uses: ./.github/workflows/changes.yaml
     if: |
       github.event_name == 'pull_request' &&
       !github.event.pull_request.draft
 
 
   test:
-    name: "Test meshcentral"
+    name: "Test: ${{ matrix.name }}"
     needs: [changes]
     runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'pull_request' &&
-      !github.event.pull_request.draft &&
-      needs.changes.outputs.docker == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.changes.outputs.images_matrix) }}
     steps:
+      - name: Check if build should run
+        id: should_run
+        run: echo "run=${{ fromJSON(needs.changes.outputs.changes || '{}')[matrix.name] == 'true' }}" >> "$GITHUB_OUTPUT"
+
       - name: Checkout
         uses: actions/checkout@v4
+        if: steps.should_run.outputs.run == 'true'
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
+        if: steps.should_run.outputs.run == 'true'
         with:
           node-version: "24.x"
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
+        if: steps.should_run.outputs.run == 'true'
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
+        if: steps.should_run.outputs.run == 'true'
         with:
           platforms: linux/amd64,linux/arm64
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        if: steps.should_run.outputs.run == 'true'
 
       - name: Generate metadata
         id: meta
         uses: docker/metadata-action@v5
+        if: steps.should_run.outputs.run == 'true'
         with:
-          images: ${{ env.REGISTRY }}/${{ env.ORGANISATION }}/${{ env.REPOSITORY }}/meshcentral
+          images: ${{ env.REGISTRY }}/${{ env.ORGANISATION }}/${{ env.REPOSITORY }}/${{ matrix.name }}
           tags: |
             type=ref,event=tag
             type=raw,value=${{ needs.changes.outputs.test_commit_sha }}
@@ -88,9 +98,10 @@ jobs:
       - name: Build image
         id: docker_build
         uses: docker/build-push-action@v6
+        if: steps.should_run.outputs.run == 'true'
         with:
-          context: .
-          file: ./docker/Dockerfile
+          context: ${{ matrix.context }}
+          file: ${{ matrix.path }}/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: false
           provenance: false
@@ -103,10 +114,7 @@ jobs:
     name: "Test Helm Chart"
     needs: [changes]
     runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'pull_request' &&
-      !github.event.pull_request.draft &&
-      needs.changes.outputs.helm == 'true'
+    if: fromJSON(needs.changes.outputs.changes || '{}').helm == 'true'  # draft gate inherited from changes
     steps:
       - name: Checkout
         uses: actions/checkout@v4