container-runtime-contract.yml

name: Container runtime contracts

on:
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/container-runtime-contract.yml'
      - 'governance/container-images.json'
      - 'governance/service-operations.json'
      - 'infra/**'
      - 'scripts/container-runtime-contract.mjs'
      - 'scripts/container-runtime-contract.test.mjs'
      - 'scripts/ci-affected-scope.mjs'
      - 'scripts/ci-affected-scope.test.mjs'
      - 'scripts/service-operations.mjs'
  push:
    branches: [main]
    paths:
      - '.github/workflows/container-runtime-contract.yml'
      - 'governance/container-images.json'
      - 'governance/service-operations.json'
      - 'infra/**'
      - 'scripts/container-runtime-contract.mjs'
      - 'scripts/container-runtime-contract.test.mjs'
      - 'scripts/ci-affected-scope.mjs'
      - 'scripts/ci-affected-scope.test.mjs'
      - 'scripts/service-operations.mjs'

permissions: {}

concurrency:
  group: container-runtime-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  scope:
    name: Select affected runtime images
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.scope.outputs.matrix }}
      has-runtime: ${{ steps.scope.outputs.has-runtime }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.0

      - name: Resolve runtime contexts from the changed-file graph
        id: scope
        env:
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PUSH_BASE_SHA: ${{ github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          BASE_SHA="$PR_BASE_SHA"
          if [ -z "$BASE_SHA" ]; then BASE_SHA="$PUSH_BASE_SHA"; fi
          if [ -z "$BASE_SHA" ] ||
             [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ] ||
             ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
            SCOPE=$(node scripts/ci-affected-scope.mjs --all)
          else
            SCOPE=$(node scripts/ci-affected-scope.mjs --base "$BASE_SHA" --head "$HEAD_SHA")
          fi
          MATRIX=$(jq -c '.runtimeMatrix' <<<"$SCOPE")
          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
          echo "has-runtime=$(jq -r '.include | length > 0' <<<"$MATRIX")" >> "$GITHUB_OUTPUT"
          echo "Runtime images: $(jq -c '[.include[].component.name]' <<<"$MATRIX")" >> "$GITHUB_STEP_SUMMARY"

  runtime:
    name: Runtime / ${{ matrix.component.name }}
    if: needs.scope.outputs.has-runtime == 'true'
    needs: scope
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    permissions:
      contents: read
    strategy:
      fail-fast: true
      max-parallel: 7
      matrix: ${{ fromJSON(needs.scope.outputs.matrix) }}
    services:
      mysql:
        image: mysql@sha256:b3b90af2a6552ae30c266fdb7d5dd55f3afb72404bb78d37fe8a23eb857fd3fb
        env:
          MYSQL_DATABASE: container_contract
          MYSQL_ROOT_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
        ports:
          - 3306:3306
        options: >-
          --health-cmd "mysqladmin ping --host 127.0.0.1 --password=$MYSQL_ROOT_PASSWORD"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 30
      mongo:
        image: mongo@sha256:5351bff2b5d1563e3fa603a74b9be85ef9323e10aeb0b45cea933a93876e77fd
        ports:
          - 27017:27017
        options: >-
          --health-cmd "mongosh --quiet --eval 'quit(db.runCommand({ping:1}).ok ? 0 : 2)'"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.18.0

      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build the exact component image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ matrix.component.path }}
          file: ${{ matrix.component.path }}/Dockerfile
          platforms: linux/amd64
          load: true
          push: false
          provenance: false
          sbom: false
          tags: ts-stack-${{ matrix.component.name }}:contract
          cache-from: type=gha,scope=runtime-${{ matrix.component.name }}
          cache-to: type=gha,mode=max,scope=runtime-${{ matrix.component.name }}

      - name: Build Wallet Infrastructure dependency from the same source
        if: matrix.component.wallet
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: infra/wallet-infra
          file: infra/wallet-infra/Dockerfile
          platforms: linux/amd64
          load: true
          push: false
          provenance: false
          sbom: false
          tags: ts-stack-wallet-infra:contract-dependency
          cache-from: type=gha,scope=runtime-wallet-infra

      - name: Isolate service migration schemas
        env:
          CONTRACT_DB_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
        run: |
          docker run --rm --network host \
            --env MYSQL_PWD="$CONTRACT_DB_PASSWORD" \
            mysql@sha256:b3b90af2a6552ae30c266fdb7d5dd55f3afb72404bb78d37fe8a23eb857fd3fb \
            mysql --host 127.0.0.1 --user root --execute \
            "CREATE DATABASE IF NOT EXISTS container_contract_message;
            CREATE DATABASE IF NOT EXISTS container_contract_overlay;
            CREATE DATABASE IF NOT EXISTS container_contract_wab;
            CREATE DATABASE IF NOT EXISTS container_contract_wallet;"

      - name: Exercise the complete runtime contract
        env:
          CONTRACT_DB_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
        run: >-
          node scripts/container-runtime-contract.mjs
          --component "${{ matrix.component.name }}"
          --image "ts-stack-${{ matrix.component.name }}:contract"
          ${{ matrix.component.wallet && '--wallet-image ts-stack-wallet-infra:contract-dependency' || '' }}

      - name: Preserve container logs on failure
        if: failure()
        run: |
          mkdir -p container-contract-logs
          for container in $(docker ps --all --format '{{.Names}}' --filter name=contract-); do
            docker logs "$container" > "container-contract-logs/$container.log" 2>&1 || true
            docker inspect "$container" > "container-contract-logs/$container.inspect.json" || true
          done

      - name: Upload failed runtime evidence
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: container-runtime-${{ matrix.component.name }}-${{ github.run_attempt }}
          path: container-contract-logs
          if-no-files-found: ignore
          retention-days: 30