Docker workflow

Author: WinterWollf

.github/workflows/docker-quality.yml

@@ -0,0 +1,111 @@
+name: Dockerfiles CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+
+concurrency:
+  group: docker-quality-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint-dockerfiles:
+    name: Lint Dockerfiles (hadolint)
+    runs-on: self-hosted # ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Hadolint (Dockerfile.api)
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile.api
+
+      - name: Hadolint (Dockerfile.nginx)
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile.nginx
+
+      - name: Validate docker-compose.yml
+        run: docker compose -f docker-compose.yml config -q
+
+  build-and-test:
+    name: Build & smoke tests
+    runs-on: self-hosted # ubuntu-latest
+    needs: lint-dockerfiles
+    strategy:
+      matrix:
+        include:
+          - name: api
+            dockerfile: Dockerfile.api
+            context: .
+          - name: nginx
+            dockerfile: Dockerfile.nginx
+            context: .
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image (${{ matrix.name }})
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.dockerfile }}
+          tags: local/${{ matrix.name }}:ci-${{ github.sha }}
+          load: true
+          push: false
+          provenance: false
+          sbom: false
+          cache-from: type=registry,ref=local/${{ matrix.name }}:buildcache
+          cache-to: type=inline
+
+      - name: Run NGINX container (smoke test)
+        if: matrix.name == 'nginx'
+        run: |
+          set -euo pipefail
+          CONTAINER_NAME=nginx-smoke-${GITHUB_RUN_ID}
+          docker run -d --rm --name "$CONTAINER_NAME" -p 8080:80 local/nginx:ci-${GITHUB_SHA}
+
+          for i in {1..30}; do
+            STATUS=$(docker inspect --format='{{json .State.Health.Status}}' "$CONTAINER_NAME" | tr -d '"')
+            if [ "$STATUS" = "healthy" ]; then
+              echo "Container is healthy."
+              break
+            fi
+            sleep 2
+          done
+
+          STATUS=$(docker inspect --format='{{json .State.Health.Status}}' "$CONTAINER_NAME" | tr -d '"')
+          if [ "$STATUS" != "healthy" ]; then
+            echo "::error::Container did not become healthy. Status=$STATUS"
+            docker logs "$CONTAINER_NAME" || true
+            docker inspect "$CONTAINER_NAME" || true
+            exit 1
+          fi
+
+          curl -fsS http://localhost:8080/ >/dev/null
+
+          docker kill "$CONTAINER_NAME" >/dev/null
+
+      - name: Run API container (smoke run)
+        if: matrix.name == 'api'
+        run: |
+          set -euo pipefail
+          CONTAINER_NAME=api-smoke-${GITHUB_RUN_ID}
+          docker run -d --rm --name "$CONTAINER_NAME" local/api:ci-${GITHUB_SHA} || (echo "::warning::API container failed to start"; exit 1)
+          sleep 5
+          if ! docker ps --filter "name=$CONTAINER_NAME" --format '{{.Names}}' | grep -q "$CONTAINER_NAME"; then
+            echo "::error::API container is not running after 5s."
+            docker logs "$CONTAINER_NAME" || true
+            exit 1
+          fi
+          docker kill "$CONTAINER_NAME" >/dev/null