container.yml

# ────────────────────────────────────────────────────────────────────────────────
# CI — AOT Builds + Agent Container
#
# Triggered automatically when CI1 (Unit Tests) passes on main, or manually.
#
# Produces:
#   • aot-linux-x64          — BareMetalWeb.Host AOT binary (Ubuntu 22.04 runner)
#   • aot-linux-arm64        — BareMetalWeb.Host AOT binary (Ubuntu 24.04 arm runner)
#   • aot-linux-arm64-bookworm — BareMetalWeb.Host AOT binary (Debian bookworm, glibc 2.36)
#   • bmw-agent-linux-x64    — bmw-agent AOT binary
#   • bmw-agent-linux-arm64  — bmw-agent AOT binary
#
# All artifacts are uploaded to GitHub Actions for later use by the agent bootstrap
# system.  There is NO deployment step — the agent downloads and installs the
# correct versioned binary itself.
# ────────────────────────────────────────────────────────────────────────────────
name: "2 · CI2 — AOT Builds & Agent Container"

run-name: "2 · CI2 — AOT Builds & Agent Container — V${{ vars.MAJOR_VERSION || '1' }}.${{ github.run_number }}"

on:
  workflow_run:
    workflows: ["1 · CI1 — Tests & JIT Build"]
    types: [completed]
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ci2-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  # ── Gate: skip if CI1 failed ────────────────────────────────────────────
  gate:
    name: Check CI1 result
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'workflow_dispatch' ||
      github.event.workflow_run.conclusion == 'success'
    steps:
      - run: echo "CI1 passed — proceeding with AOT builds"

  # ── Version ─────────────────────────────────────────────────────────────
  version:
    name: Compute version
    needs: gate
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      info_version: ${{ steps.version.outputs.info_version }}
      assembly_version: ${{ steps.version.outputs.assembly_version }}
    steps:
      - name: Compute version
        id: version
        run: |
          MAJOR="${{ vars.MAJOR_VERSION || '1' }}"
          DATE="$(date +%Y%m%d)"
          BUILD="${{ github.run_number }}"
          SHA="${GITHUB_SHA:0:7}"
          echo "tag=${MAJOR}.${DATE}.${BUILD}" >> $GITHUB_OUTPUT
          echo "info_version=${MAJOR}.${DATE}.${BUILD}+${SHA}" >> $GITHUB_OUTPUT
          echo "assembly_version=${MAJOR}.0.0.${BUILD}" >> $GITHUB_OUTPUT

  # ── AOT: BareMetalWeb.Host linux-x64 ────────────────────────────────────
  aot-host-linux-x64:
    name: "AOT Host · linux-x64"
    needs: version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: nuget-

      - name: Install native AOT prerequisites
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang zlib1g-dev

      - name: AOT publish (linux-x64)
        run: |
          dotnet publish BareMetalWeb.Host/BareMetalWeb.Host.csproj \
            --configuration Release \
            --runtime linux-x64 \
            --self-contained \
            --output ./publish \
            -p:AssemblyVersion=${{ needs.version.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.version.outputs.assembly_version }} \
            -p:InformationalVersion=${{ needs.version.outputs.info_version }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: aot-linux-x64
          path: ./publish
          retention-days: 30

  # ── AOT: BareMetalWeb.Host linux-arm64 (Ubuntu 24.04) ───────────────────
  aot-host-linux-arm64:
    name: "AOT Host · linux-arm64"
    needs: version
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: nuget-

      - name: Install native AOT prerequisites
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang zlib1g-dev

      - name: AOT publish (linux-arm64)
        run: |
          dotnet publish BareMetalWeb.Host/BareMetalWeb.Host.csproj \
            --configuration Release \
            --runtime linux-arm64 \
            --self-contained \
            --output ./publish \
            -p:AssemblyVersion=${{ needs.version.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.version.outputs.assembly_version }} \
            -p:InformationalVersion=${{ needs.version.outputs.info_version }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: aot-linux-arm64
          path: ./publish
          retention-days: 30

  # ── AOT: BareMetalWeb.Host linux-arm64 (Debian bookworm, glibc 2.36) ───
  aot-host-linux-arm64-bookworm:
    name: "AOT Host · linux-arm64 (bookworm/glibc 2.36)"
    needs: version
    runs-on: ubuntu-24.04-arm
    container:
      image: debian:bookworm
    steps:
      - name: Install build dependencies
        run: |
          apt-get update && apt-get install -y --no-install-recommends \
            curl git ca-certificates clang zlib1g-dev

      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: AOT publish (linux-arm64, bookworm)
        run: |
          dotnet publish BareMetalWeb.Host/BareMetalWeb.Host.csproj \
            --configuration Release \
            --runtime linux-arm64 \
            --self-contained \
            --output ./publish \
            -p:AssemblyVersion=${{ needs.version.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.version.outputs.assembly_version }} \
            -p:InformationalVersion=${{ needs.version.outputs.info_version }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: aot-linux-arm64-bookworm
          path: ./publish
          retention-days: 30

  # ── AOT: bmw-agent linux-x64 ─────────────────────────────────────────────
  aot-agent-linux-x64:
    name: "AOT Agent · linux-x64"
    needs: version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: nuget-

      - name: Install native AOT prerequisites
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang zlib1g-dev

      - name: AOT publish agent (linux-x64)
        run: |
          dotnet publish BareMetalWeb.Agent/BareMetalWeb.Agent.csproj \
            --configuration Release \
            --runtime linux-x64 \
            --self-contained \
            --output ./agent-out \
            -p:AssemblyVersion=${{ needs.version.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.version.outputs.assembly_version }} \
            -p:InformationalVersion=${{ needs.version.outputs.info_version }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bmw-agent-linux-x64
          path: ./agent-out
          retention-days: 30

  # ── AOT: bmw-agent linux-arm64 ───────────────────────────────────────────
  aot-agent-linux-arm64:
    name: "AOT Agent · linux-arm64"
    needs: version
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: nuget-

      - name: Install native AOT prerequisites
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang zlib1g-dev

      - name: AOT publish agent (linux-arm64)
        run: |
          dotnet publish BareMetalWeb.Agent/BareMetalWeb.Agent.csproj \
            --configuration Release \
            --runtime linux-arm64 \
            --self-contained \
            --output ./agent-out \
            -p:AssemblyVersion=${{ needs.version.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.version.outputs.assembly_version }} \
            -p:InformationalVersion=${{ needs.version.outputs.info_version }}

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: bmw-agent-linux-arm64
          path: ./agent-out
          retention-days: 30

  # ── Agent container (build verification — no push) ──────────────────────
  agent-container:
    name: "Agent container (build verification)"
    needs: version
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build agent container image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.agent
          platforms: linux/arm64
          push: false
          tags: bmw-agent:${{ needs.version.outputs.tag }}-linux-arm64
          labels: |
            org.opencontainers.image.title=BareMetalWeb Agent
            org.opencontainers.image.version=${{ needs.version.outputs.tag }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}

  # ── Summary ────────────────────────────────────────────────────────────
  summary:
    name: Build summary
    needs:
      - version
      - aot-host-linux-x64
      - aot-host-linux-arm64
      - aot-host-linux-arm64-bookworm
      - aot-agent-linux-x64
      - aot-agent-linux-arm64
      - agent-container
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Fail if gate was skipped
        if: needs.version.result == 'skipped'
        run: |
          echo "::error::CI1 did not pass — CI2 skipped."
          exit 1

      - name: Summary
        if: needs.version.result != 'skipped'
        run: |
          TAG="${{ needs.version.outputs.tag }}"
          echo "### 🏗️ CI2 Build Summary (${TAG})" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Artifact | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| AOT Host linux-x64 | ${{ needs.aot-host-linux-x64.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| AOT Host linux-arm64 | ${{ needs.aot-host-linux-arm64.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| AOT Host linux-arm64 (bookworm) | ${{ needs.aot-host-linux-arm64-bookworm.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| AOT Agent linux-x64 | ${{ needs.aot-agent-linux-x64.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| AOT Agent linux-arm64 | ${{ needs.aot-agent-linux-arm64.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Agent container build | ${{ needs.agent-container.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "All artifacts available for download from this run." >> $GITHUB_STEP_SUMMARY
          echo "The agent self-registers and downloads the correct binary at runtime — no CD step needed." >> $GITHUB_STEP_SUMMARY