bleeding.yml

name: Bleeding Docker Image CI

on:
  push:
    branches:
    - main
  pull_request:
  schedule:
  - cron: 0 4 * * *

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  bleeding:
    runs-on: ubuntu-24.04
    outputs:
      weblate_sha: ${{ steps.get_sha.outputs.sha }}
      weblate_date: ${{ steps.get_date.outputs.date }}
    steps:
    - id: get_sha
      run: echo "sha=$(git ls-remote --quiet https://github.com/WeblateOrg/weblate.git HEAD | awk '{print $1}')" >> $GITHUB_OUTPUT
    - id: get_date
      run: echo "date=$(date --iso-8601=ns)" >> $GITHUB_OUTPUT
  build:
    runs-on: ubuntu-24.04
    name: Build, bleeding, ${{ matrix.architecture }}
    needs:
    - bleeding
    strategy:
      matrix:
        architecture: [linux/amd64]
    env:
      MATRIX_ARCHITECTURE: ${{ matrix.architecture }}
    steps:
    - uses: actions/checkout@v4
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Configure Docker build
      run: .github/bin/get-buildx-args
    - name: Cache
      uses: actions/cache@v4
      id: cache
      with:
        path: uv-cache
        key: uv-cache-${{ hashFiles('Dockerfile') }}-${{ matrix.architecture }}
    - name: inject cache into docker
      uses: reproducible-containers/buildkit-cache-dance@v3.1.2
      with:
        cache-map: |
          {
            "uv-cache": "/.uv-cache"
          }
        skip-extraction: ${{ steps.cache.outputs.cache-hit }}
    - name: Build the Docker image
      run: .github/bin/docker-build

  buildx:
    runs-on: ubuntu-24.04
    name: Build, bleeding, ${{ matrix.architecture }}
    needs:
    - bleeding
    strategy:
      matrix:
        architecture:
        - linux/arm64
    env:
      MATRIX_ARCHITECTURE: ${{ matrix.architecture }}
    steps:
    - uses: actions/checkout@v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3.2.0
      with:
        platforms: ${{ matrix.architecture }}
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Configure Docker build
      run: .github/bin/get-buildx-args
    - name: Cache
      uses: actions/cache@v4
      id: cache
      with:
        path: uv-cache
        key: uv-cache-${{ hashFiles('Dockerfile') }}-${{ matrix.architecture }}
    - name: inject cache into docker
      uses: reproducible-containers/buildkit-cache-dance@v3.1.2
      with:
        cache-map: |
          {
            "uv-cache": "/.uv-cache"
          }
        skip-extraction: ${{ steps.cache.outputs.cache-hit }}
    - name: Build the Docker image
      run: .github/bin/docker-build

  test-basic:
    runs-on: ubuntu-24.04
    name: Test basic, bleeding
    needs:
    - bleeding
    - build
    env:
      MATRIX_ARCHITECTURE: linux/amd64
      COMPOSE_PROJECT_NAME: wl
      PYTHONUNBUFFERED: 1
      TEST_CONTAINER: weblate/weblate:test
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Generate configuration
      run: |
        cd docker-compose
        ./test-generate
    - name: Startup container
      run: |
        cd docker-compose
        ./test-boot
    - name: List Python packages
      run: |
        cd docker-compose
        ./test-pip
    - name: Inspect container
      run: |
        cd docker-compose
        ./test-inspect
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Check service health status
      run: |
        cd docker-compose
        ./test-health
    - name: Run Django Checks
      run: |
        cd docker-compose
        ./test-checks
    - name: Verify supervisor
      run: |
        cd docker-compose
        ./test-supervisor
    - name: Test admin creation
      run: |
        cd docker-compose
        ./test-admin
    - name: Test commands
      run: |
        cd docker-compose
        ./test-commands
    - name: Display logs
      if: always()
      run: |
        cd docker-compose
        ./test-logs
    - name: Stop Weblate service
      run: |
        cd docker-compose
        docker compose stop weblate
    - name: Start Weblate service
      run: |
        cd docker-compose
        docker compose start weblate
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Shutdown service
      run: |
        cd docker-compose
        ./test-stop

  test-novolume:
    runs-on: ubuntu-24.04
    name: Test novolume, bleeding
    needs:
    - bleeding
    - build
    - test-basic
    env:
      MATRIX_ARCHITECTURE: linux/amd64
      COMPOSE_PROJECT_NAME: wl
      PYTHONUNBUFFERED: 1
      TEST_CONTAINER: weblate/weblate:test
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Generate configuration
      run: |
        cd docker-compose
        ./test-generate 8080 http read-write
    - name: Startup container
      run: |
        cd docker-compose
        ./test-boot
    - name: List Python packages
      run: |
        cd docker-compose
        ./test-pip
    - name: Inspect container
      run: |
        cd docker-compose
        ./test-inspect
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Check service health status
      run: |
        cd docker-compose
        ./test-health
    - name: Run Django Checks
      run: |
        cd docker-compose
        ./test-checks
    - name: Verify supervisor
      run: |
        cd docker-compose
        ./test-supervisor
    - name: Test admin creation
      run: |
        cd docker-compose
        ./test-admin
    - name: Test commands
      run: |
        cd docker-compose
        ./test-commands
    - name: Display logs
      if: always()
      run: |
        cd docker-compose
        ./test-logs
    - name: Stop Weblate service
      run: |
        cd docker-compose
        docker compose stop weblate
    - name: Start Weblate service
      run: |
        cd docker-compose
        docker compose start weblate
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Shutdown service
      run: |
        cd docker-compose
        ./test-stop

  test-saml:
    runs-on: ubuntu-24.04
    name: Test SAML, bleeding
    needs:
    - bleeding
    - build
    - test-basic
    env:
      MATRIX_ARCHITECTURE: linux/amd64
      COMPOSE_PROJECT_NAME: wl
      PYTHONUNBUFFERED: 1
      TEST_CONTAINER: weblate/weblate:test
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Generate configuration
      env:
        TEST_EXTRA_ENV: 'WEBLATE_SAML_IDP_URL: https://example.com/idp'
      run: |
        cd docker-compose
        ./test-generate
    - name: Startup container
      run: |
        cd docker-compose
        ./test-boot
    - name: List Python packages
      run: |
        cd docker-compose
        ./test-pip
    - name: Inspect container
      run: |
        cd docker-compose
        ./test-inspect
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Check service health status
      run: |
        cd docker-compose
        ./test-health
    - name: Run Django Checks
      run: |
        cd docker-compose
        ./test-checks
    - name: Verify supervisor
      run: |
        cd docker-compose
        ./test-supervisor
    - name: Test admin creation
      run: |
        cd docker-compose
        ./test-admin
    - name: Verify SAML certificate
      run: |
        cd docker-compose
        ./test-saml
    - name: Display logs
      if: always()
      run: |
        cd docker-compose
        ./test-logs
    - name: Shutdown service
      run: |
        cd docker-compose
        ./test-stop

  test-split:
    runs-on: ubuntu-24.04
    name: Test split, bleeding
    needs:
    - bleeding
    - build
    - test-basic
    env:
      MATRIX_ARCHITECTURE: linux/amd64
      COMPOSE_PROJECT_NAME: wl
      PYTHONUNBUFFERED: 1
      TEST_CONTAINER: weblate/weblate:test
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Generate configuration
      run: |
        cd docker-compose
        ./test-generate 8080 http split
    - name: Startup container
      run: |
        cd docker-compose
        ./test-boot
    - name: List Python packages
      run: |
        cd docker-compose
        ./test-pip
    - name: Inspect container
      run: |
        cd docker-compose
        ./test-inspect
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Check service health status
      run: |
        cd docker-compose
        ./test-health
    - name: Run Django Checks
      run: |
        cd docker-compose
        ./test-checks
    - name: Verify supervisor
      run: |
        cd docker-compose
        ./test-supervisor
    - name: Test admin creation
      run: |
        cd docker-compose
        ./test-admin
    - name: Display logs
      if: always()
      run: |
        cd docker-compose
        ./test-logs
    - name: Shutdown service
      run: |
        cd docker-compose
        ./test-stop

  test-single-celery:
    runs-on: ubuntu-24.04
    name: Test single celery process, bleeding
    needs:
    - bleeding
    - build
    - test-basic
    env:
      MATRIX_ARCHITECTURE: linux/amd64
      COMPOSE_PROJECT_NAME: wl
      PYTHONUNBUFFERED: 1
      TEST_CONTAINER: weblate/weblate:test
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Generate configuration
      run: |
        cd docker-compose
        ./test-generate 8080 http split
    - name: Startup container
      run: |
        cd docker-compose
        ./test-boot
    - name: List Python packages
      run: |
        cd docker-compose
        ./test-pip
    - name: Inspect container
      run: |
        cd docker-compose
        ./test-inspect
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Check service health status
      run: |
        cd docker-compose
        ./test-health
    - name: Run Django Checks
      run: |
        cd docker-compose
        ./test-checks
    - name: Verify supervisor
      run: |
        cd docker-compose
        ./test-supervisor
    - name: Test admin creation
      run: |
        cd docker-compose
        ./test-admin
    - name: Display logs
      if: always()
      run: |
        cd docker-compose
        ./test-logs
    - name: Shutdown service
      run: |
        cd docker-compose
        ./test-stop

  test-ssl:
    runs-on: ubuntu-24.04
    name: Test SSL, bleeding
    needs:
    - bleeding
    - build
    - test-basic
    env:
      MATRIX_ARCHITECTURE: linux/amd64
      COMPOSE_PROJECT_NAME: wl
      PYTHONUNBUFFERED: 1
      TEST_CONTAINER: weblate/weblate:test
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Generate configuration
      run: |
        cd docker-compose
        ./test-generate 4443 https
    - name: Generate SSL certificate
      run: |
        cd docker-compose
        docker compose up --no-start
        VOLUMEPATH=$(docker volume inspect -f '{{.Mountpoint}}' wl_weblate-data)
        sudo mkdir -p $VOLUMEPATH/ssl
        sudo openssl req -x509 -nodes -days 365 -subj "/CN=localhost" -newkey rsa:2048 -keyout $VOLUMEPATH/ssl/privkey.pem -out $VOLUMEPATH/ssl/fullchain.pem
        sudo chown -R 1000:1000 $VOLUMEPATH/ssl
    - name: Startup container
      run: |
        cd docker-compose
        ./test-boot
    - name: List Python packages
      run: |
        cd docker-compose
        ./test-pip
    - name: Inspect container
      run: |
        cd docker-compose
        ./test-inspect
    - name: Check service is running
      run: |
        cd docker-compose
        ./test-online
    - name: Check service health status
      run: |
        cd docker-compose
        ./test-health
    - name: Run Django Checks
      run: |
        cd docker-compose
        ./test-checks
    - name: Verify supervisor
      run: |
        cd docker-compose
        ./test-supervisor
    - name: Test admin creation
      run: |
        cd docker-compose
        ./test-admin
    - name: Display logs
      if: always()
      run: |
        cd docker-compose
        ./test-logs
    - name: Shutdown service
      run: |
        cd docker-compose
        ./test-stop

  anchore:
    runs-on: ubuntu-24.04
    name: Anchore Container Scan
    needs:
    - bleeding
    - build
    permissions:
      security-events: write
    env:
      MATRIX_ARCHITECTURE: linux/amd64
    steps:
    - uses: actions/checkout@v4
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Checkout the code
      uses: actions/checkout@v4
    - name: Anchore scan action
      uses: anchore/scan-action@v5
      id: scan
      with:
        image: weblate/weblate:test
        fail-build: false
    - name: Upload Anchore Scan Report
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: ${{ steps.scan.outputs.sarif }}

  trivy:
    runs-on: ubuntu-24.04
    name: Trivy Container Scan
    needs:
    - bleeding
    - build
    permissions:
      security-events: write
    env:
      MATRIX_ARCHITECTURE: linux/amd64
    steps:
    - uses: actions/checkout@v4
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Build the Docker image
      run: .github/bin/docker-build load
    - name: List Docker images
      run: docker image ls --all
    - name: Checkout the code
      uses: actions/checkout@v4
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@0.28.0
      env:
        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
      with:
        image-ref: weblate/weblate:test
        format: template
        template: '@/contrib/sarif.tpl'
        output: trivy-results.sarif
        severity: CRITICAL,HIGH

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-results.sarif
    - uses: actions/upload-artifact@v4
      with:
        name: Trivy scan SARIF
        path: trivy-results.sarif

  merge:
    runs-on: ubuntu-24.04
    name: Merge images
    needs:
    - build
    - buildx
    - bleeding
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3.2.0
      with:
        platforms: all
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Configure Docker build
      run: .github/bin/get-buildx-args
    - name: Merge the Docker images
      run: .github/bin/docker-build

  push_dockerhub:
    runs-on: ubuntu-24.04
    name: Publish to Docker Hub, stable
    needs:
    - test-basic
    - test-saml
    - test-split
    - test-single-celery
    - test-novolume
    - test-ssl
    - buildx
    - anchore
    - trivy
    - merge
    - bleeding
    if: ${{ (startsWith(github.ref, 'refs/tags/') || (github.ref == 'refs/heads/main')) && github.repository == 'WeblateOrg/docker' }}
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3.2.0
      with:
        platforms: all
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: DockerHub login
      run: echo "${{ secrets.DOCKERHUB_ACCESS_TOKEN }}" | docker login --username "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Configure Docker build
      run: .github/bin/get-buildx-args publish-bleeding
    - name: Publish the Docker images
      run: .github/bin/docker-build publish-bleeding

  push_github:
    runs-on: ubuntu-24.04
    name: Publish to GitHub, stable
    permissions:
      packages: write
    needs:
    - test-basic
    - test-saml
    - test-split
    - test-single-celery
    - test-novolume
    - test-ssl
    - buildx
    - anchore
    - trivy
    - merge
    - bleeding
    if: ${{ (startsWith(github.ref, 'refs/tags/') || (github.ref == 'refs/heads/main')) && github.repository == 'WeblateOrg/docker' }}
    env:
      DOCKER_IMAGE: ghcr.io/weblateorg/weblate
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3.2.0
      with:
        platforms: all
    - name: Expose GitHub Runtime
      uses: crazy-max/ghaction-github-runtime@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3.7.1
      with:
        # renovate: datasource=github-releases depName=docker/buildx
        version: v0.18.0
    - name: Login to GitHub Container Registry
      if: ${{ github.event_name != 'pull_request'}}
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Adjust bleeding edge image
      run: .github/bin/bleeding ${{needs.bleeding.outputs.weblate_sha}}  ${{needs.bleeding.outputs.weblate_date}}
    - name: Configure Docker build
      run: .github/bin/get-buildx-args publish-bleeding
    - name: Publish the Docker images
      run: .github/bin/docker-build publish-bleeding