docker-build.yml

name: 🐳 Docker Build & Push

on:
  push:
    branches: [ main, master ]
    tags: [ 'v*.*.*' ]
    paths:
      - 'Dockerfile*'
      - 'app.py'
      - 'requirements.txt'
      - '.github/workflows/docker-build.yml'
  pull_request:
    branches: [ main, master ]
    paths:
      - 'Dockerfile*'
      - 'app.py'
      - 'requirements.txt'
      - '.github/workflows/docker-build.yml'
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      push_image:
        description: 'Whether to push image to registry'
        required: false
        default: true
        type: boolean

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: fqscfqj/parakeet-api-docker

jobs:
  build:
    name: 🔨 Build Full Image
    runs-on: ubuntu-latest
    outputs:
      should-push: ${{ steps.check-push.outputs.should-push }}
      image-tags: ${{ steps.meta.outputs.tags }}
    
    permissions:
      contents: read
      packages: write
    
    steps:
      - name: 📥 Checkout repository
        uses: actions/checkout@v4

      - name: 🔍 Check push conditions
        id: check-push
        run: |
          echo "=== Push condition debug info ==="
          echo "Event name: ${{ github.event_name }}"
          echo "Push image input: ${{ github.event.inputs.push_image }}"
          echo "Is default branch: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}"
          echo "Current ref: ${{ github.ref }}"
          echo "Actor: ${{ github.actor }}"
          echo ""
          
          # Calculate whether to push
          if [[ "${{ github.event_name }}" != "pull_request" ]]; then
            if [[ "${{ github.event_name }}" != "workflow_dispatch" ]] || [[ "${{ github.event.inputs.push_image }}" != "false" ]]; then
              echo "should-push=true" >> $GITHUB_OUTPUT
              echo "✅ Will push image to GHCR"
            else
              echo "should-push=false" >> $GITHUB_OUTPUT
              echo "❌ Will not push image (manual trigger with false setting)"
            fi
          else
            echo "should-push=false" >> $GITHUB_OUTPUT
            echo "❌ Will not push image (Pull Request)"
          fi

      - name: 🧹 Free up disk space
        run: |
          echo "=== Disk cleanup before build ==="
          df -h
          echo ""
          
          # Remove unnecessary pre-installed software and data
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /opt/ghc
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /usr/local/share/boost
          sudo rm -rf /usr/lib/jvm
          sudo rm -rf /usr/share/swift
          sudo rm -rf /usr/local/julia*
          sudo rm -rf /usr/share/kotlinc
          sudo rm -rf /usr/local/share/powershell
          sudo rm -rf /usr/share/vim/vim*/doc/*
          
          # Clean up apt cache
          sudo apt-get autoremove -y >/dev/null 2>&1
          sudo apt-get autoclean -y >/dev/null 2>&1
          sudo apt-get clean -y >/dev/null 2>&1
          
          # Clean up Docker cache
          docker system prune -a -f --volumes >/dev/null 2>&1 || true
          
          echo "=== Disk usage after cleanup ==="
          df -h
          echo ""

      - name: 🏗️ Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64
          driver-opts: |
            image=moby/buildkit:latest
            network=host

      - name: 🔐 Log in to Container Registry
        if: ${{ steps.check-push.outputs.should-push == 'true' }}
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🏷️ Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha,prefix=commit-{{sha}}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=Parakeet ASR API (Slim)
            org.opencontainers.image.description=NeMo Parakeet ASR API Docker image - Slim version with optimized size and performance
            org.opencontainers.image.vendor=fqscfqj

      - name: 🔨 Build Docker image (Full)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          platforms: linux/amd64
          push: ${{ steps.check-push.outputs.should-push == 'true' }}
          tags: |
            ${{ steps.meta.outputs.tags }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:full
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      # (Slim 构建已移除)

      - name: 🧹 Cleanup after build
        if: always()
        run: |
          echo "=== 构建后磁盘使用情况 ==="
          df -h
          echo ""
          
          # 清理构建缓存
          docker builder prune -a -f >/dev/null 2>&1 || true
          docker system prune -a -f --volumes >/dev/null 2>&1 || true
          
          echo "=== 清理后磁盘使用情况 ==="
          df -h

      - name: ✅ Verify push success
        if: ${{ steps.check-push.outputs.should-push == 'true' }}
        run: |
          echo "=== Verify image push status ==="
          
          # Wait a bit for image to finish pushing completely
          sleep 5
          
          # Check if image was successfully pushed to GHCR
          if docker manifest inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest > /dev/null 2>&1; then
            echo "✅ Image successfully pushed to GHCR"
            echo "🔗 Image URL: https://github.com/fqscfqj/parakeet-api-docker/pkgs/container/parakeet-api-docker"
          else
            echo "❌ Image push may have failed, please check permissions and network"
            exit 1
          fi

          # Check if FULL image was successfully pushed
          if docker manifest inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:full > /dev/null 2>&1; then
            echo "✅ Full image successfully pushed to GHCR (tag: full)"
          else
            echo "❌ Full image push may have failed, please check permissions and network"
            exit 1
          fi

      - name: 📋 Output image info
        if: ${{ steps.check-push.outputs.should-push == 'true' }}
        run: |
          echo "## 🐳 Parakeet ASR API Docker Image Build Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Image Version:** Full (Complete Environment)" >> $GITHUB_STEP_SUMMARY
          echo "**Dockerfile:** Dockerfile" >> $GITHUB_STEP_SUMMARY
          echo "**Supported Platform:** linux/amd64" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**📦 GHCR Image URL:**" >> $GITHUB_STEP_SUMMARY
          echo "🔗 https://github.com/fqscfqj/parakeet-api-docker/pkgs/container/parakeet-api-docker" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Tag Information:**" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.meta.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Usage:**" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          echo "docker run -p 5092:5092 -v ./models:/app/models:ro ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
          echo "# Or explicitly use full tag" >> $GITHUB_STEP_SUMMARY
          echo "docker run -p 5092:5092 -v ./models:/app/models:ro ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:full" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

  security-scan:
    name: 🔍 Security Scan
    runs-on: ubuntu-latest
    needs: [build]
    if: always() && needs.build.outputs.should-push == 'true' && needs.build.result == 'success'
    
    permissions:
      contents: read
      packages: read
      security-events: write
    
    steps:
      - name: 🔐 Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🔍 Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: 📤 Upload Trivy scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
          category: 'trivy-full'

  update-description:
    name: 📝 Update Package Description
    runs-on: ubuntu-latest
    needs: [build]
    if: github.ref == 'refs/heads/main' && needs.build.outputs.should-push == 'true' && needs.build.result == 'success'
    
    permissions:
      packages: write
    
    steps:
      - name: 📥 Checkout repository
        uses: actions/checkout@v4

      - name: 🔐 Log in to Container Registry  
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 📝 Update package description
        run: |
          echo \"Updating image description...\"\n          docker buildx imagetools create \\\n            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \\\n            --annotation \"index:org.opencontainers.image.description=🎙️ NeMo Parakeet ASR API - High-performance speech recognition service, supporting long audio chunking, GPU acceleration and multiple output formats. Slim version with optimized size and performance.\" \\\n            --annotation \"index:org.opencontainers.image.documentation=https://github.com/fqscfqj/parakeet-api-docker\" \\\n            --annotation \"index:org.opencontainers.image.source=https://github.com/fqscfqj/parakeet-api-docker\" \\\n            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\n          echo \"✅ Image description update complete\"



  notify-completion:
    name: 🎉 Notify Completion
    runs-on: ubuntu-latest
    needs: [build, security-scan]
    if: always() && needs.build.outputs.should-push == 'true'
    
    steps:
      - name: 📊 Generate summary
        run: |
          echo \"## 🐳 Parakeet ASR API Docker Image Build Complete\" >> $GITHUB_STEP_SUMMARY
          echo \"\" >> $GITHUB_STEP_SUMMARY
          echo \"**Build Results:**\" >> $GITHUB_STEP_SUMMARY
          
          # Build results
          if [ \"${{ needs.build.result }}\" = \"success\" ]; then
            echo \"- ✅ Full version build: Success\" >> $GITHUB_STEP_SUMMARY
          elif [ \"${{ needs.build.result }}\" = \"skipped\" ]; then
            echo \"- ⏭️ Full version build: Skipped\" >> $GITHUB_STEP_SUMMARY
          else
            echo \"- ❌ Full version build: Failed\" >> $GITHUB_STEP_SUMMARY
          fi
          
          # Security scan results
          if [ \"${{ needs.security-scan.result }}\" = \"success\" ]; then
            echo \"- ✅ Security scan: Passed\" >> $GITHUB_STEP_SUMMARY
          elif [ \"${{ needs.security-scan.result }}\" = \"skipped\" ]; then
            echo \"- ⏭️ Security scan: Skipped\" >> $GITHUB_STEP_SUMMARY
          else
            echo \"- ❌ Security scan: Failed\" >> $GITHUB_STEP_SUMMARY
          fi
          
          echo \"\" >> $GITHUB_STEP_SUMMARY
          echo \"**Available Images:**\" >> $GITHUB_STEP_SUMMARY
          
          # Show available images based on build results
          if [ \"${{ needs.build.result }}\" = \"success\" ]; then
            echo \"- Full version: \\`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\\` (same as \\`full\\`)' >> $GITHUB_STEP_SUMMARY
          fi
          
          echo \"\" >> $GITHUB_STEP_SUMMARY
          echo \"**Usage:**\" >> $GITHUB_STEP_SUMMARY
          echo '```bash' >> $GITHUB_STEP_SUMMARY
          if [ \"${{ needs.build.result }}\" = \"success\" ]; then
            echo \"# Parakeet ASR API (Full Complete Environment)\" >> $GITHUB_STEP_SUMMARY
            echo \"docker run -p 5092:5092 -v ./models:/app/models:ro ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest\" >> $GITHUB_STEP_SUMMARY
          fi
          echo '```' >> $GITHUB_STEP_SUMMARY
          
          echo \"\" >> $GITHUB_STEP_SUMMARY
          echo \"**Image Description:**\" >> $GITHUB_STEP_SUMMARY
          echo \"- Provides complete runtime environment, easy to use out of the box\" >> $GITHUB_STEP_SUMMARY
          echo \"- Default tag \\`latest\\` points to Full version\" >> $GITHUB_STEP_SUMMARY