build.ps1

#!/usr/bin/env pwsh

# =============================================================================
# build.ps1: build script for SteeltoeOSS Docker images
# =============================================================================

# -----------------------------------------------------------------------------
# help
# -----------------------------------------------------------------------------

<#
    .SYNOPSIS
    Build Steeltoe Docker images

    .DESCRIPTION
    Builds a specified Steeltoe Docker image.

    The image is tagged '<registry>/<image>:<tag>' where <tag> is the value of -Tag if
    specified; otherwise the image's metadata/IMAGE_VERSION when running in GitHub Actions;
    otherwise 'dev' for local builds.

    .PARAMETER Help
    Print this message.

    .PARAMETER List
    List available images.

    .PARAMETER DisableCache
    Disable the Docker build layer cache. Only affects the UAA server; a no-op for the
    Java images, which build from committed source.

    .PARAMETER Name
    Docker image name.

    .PARAMETER Tag
    Override the image tag.

    .PARAMETER Registry
    Set the container registry. Defaults to steeltoe.azurecr.io.

    .PARAMETER SmokeTest
    After building, run smoke-test.ps1 to start the image and verify the health endpoint returns HTTP 200.
#>

# -----------------------------------------------------------------------------
# args
# -----------------------------------------------------------------------------

param (
    [Switch] $Help,
    [Switch] $List,
    [Switch] $DisableCache,
    [Switch] $SmokeTest,
    [String] $Name,
    [String] $Tag,
    [String] $Registry
)

$ErrorActionPreference = 'Stop'

try {

    # -----------------------------------------------------------------------------
    # impl
    # -----------------------------------------------------------------------------

    if ($Registry) {
        $DockerOrg = $Registry
    }
    else {
        $DockerOrg = "steeltoe.azurecr.io"
    }

    if ($Help) {
        Get-Help $PSCommandPath -Detailed
        return
    }

    if ($Name -And $List) {
        throw "-Name and -List are mutually exclusive"
    }

    $ImagesDirectory = Split-Path -Parent $PSCommandPath

    if ($List) {
        Get-ChildItem -Path $ImagesDirectory -Directory | Where-Object { !$_.Name.StartsWith(".") -And $_.Name -NE "workspace" } | Select-Object Name
        return
    }

    if (!$Name) {
        throw "Name not specified; run with -Help for help"
    }

    $ImageDirectory = Join-Path $ImagesDirectory $Name
    if (!(Test-Path $ImageDirectory)) {
        throw "Unknown image $Name; run with -List to list available images"
    }

    if (!(Get-Command "docker" -ErrorAction SilentlyContinue)) {
        if (Get-Command "podman" -ErrorAction SilentlyContinue) {
            Write-Host "Adding docker alias for podman"
            Set-Alias "docker" "podman"
        }
        else {
            throw "'docker' command not found"
        }
    }

    if (Test-Path (Join-Path $ImageDirectory "metadata")) {
        $Version = Get-Content (Join-Path $ImageDirectory "metadata" "IMAGE_VERSION")
    }
    else {
        throw "No metadata found for $Name"
    }

    if ($Tag) {
        $ImageNameWithTag = "$DockerOrg/${Name}:$Tag"
    }
    elseif ($env:GITHUB_ACTIONS -eq "true") {
        $ImageNameWithTag = "$DockerOrg/${Name}:$Version"
    }
    else {
        $ImageNameWithTag = "$DockerOrg/${Name}:dev"
    }

    Write-Host "This image will be available as: $ImageNameWithTag"

    if ($Name -eq "uaa-server") {
        $Dockerfile = Join-Path $ImageDirectory Dockerfile
        if (!(Test-Path $Dockerfile)) {
            throw "No Dockerfile for $Name (expected $Dockerfile)"
        }

        if ($DisableCache) {
            Write-Host "Disabling Docker build cache"
            $NoCacheArg = "--no-cache"
        }
        else {
            $NoCacheArg = ""
        }

        $docker_command = "docker build $NoCacheArg -t $ImageNameWithTag $ImageDirectory --build-arg SERVER_VERSION=$Version"
        Write-Host $docker_command
        Invoke-Expression $docker_command
    }
    else {
        $supportedImages = @("config-server", "eureka-server", "spring-boot-admin")
        if ($Name -notin $supportedImages) {
            Write-Host "$Name is not currently supported by this script"
            exit 2
        }

        $workPath = "workspace"
        if (!(Test-Path $workPath)) {
            New-Item -ItemType Directory -Path $workPath | Out-Null
        }
        Push-Location $workPath
        try {
            $serverName = $Name -replace '-', ''
            $Version = Get-Content (Join-Path $ImageDirectory "metadata" "IMAGE_VERSION")

            Write-Host "Building server: $Name@$Version"
            Write-Host "Source files: $ImageDirectory/source"
            Write-Host "Working directory: $PWD"

            # Ensure clean workspace
            Remove-Item -Recurse -Force $serverName -ErrorAction Ignore
            if (Test-Path $serverName) {
                throw "Failed to remove existing workspace $serverName"
            }

            # Copy source from committed directory
            $sourceDir = Join-Path $ImageDirectory "source"
            if (!(Test-Path $sourceDir)) {
                throw "Source directory not found at $sourceDir. Run update-project.ps1 first."
            }

            Copy-Item -Path $sourceDir -Destination $serverName -Recurse -Force

            # gradle-wrapper.jar is not committed to source; download it from the Gradle GitHub repo
            $wrapperJarPath = Join-Path $serverName "gradle" "wrapper" "gradle-wrapper.jar"
            $wrapperPropertiesPath = Join-Path $serverName "gradle" "wrapper" "gradle-wrapper.properties"
            $wrapperPropertiesContent = Get-Content $wrapperPropertiesPath -Raw
            if ($wrapperPropertiesContent -match 'distributionUrl=.*gradle-(\d+(?:\.\d+)+)-') {
                $gradleVersion = $Matches[1]
            }
            else {
                throw "Could not determine Gradle version from $wrapperPropertiesPath"
            }

            if (!(Test-Path $wrapperJarPath)) {
                Write-Host "Downloading gradle-wrapper.jar for Gradle $gradleVersion..."
                Invoke-WebRequest `
                    -Uri "https://raw.githubusercontent.com/gradle/gradle/v$gradleVersion/gradle/wrapper/gradle-wrapper.jar" `
                    -OutFile $wrapperJarPath `
                    -UseBasicParsing
            }

            # Validate the wrapper jar against Gradle's published checksum so a tampered or
            # truncated download can never run on a build machine (supply-chain integrity).
            $shaContent = (Invoke-WebRequest `
                -Uri "https://services.gradle.org/distributions/gradle-$gradleVersion-wrapper.jar.sha256" `
                -UseBasicParsing).Content
            if ($shaContent -is [byte[]]) {
                $shaContent = [System.Text.Encoding]::ASCII.GetString($shaContent)
            }
            $expectedSha = $shaContent.Trim().ToLower()
            $actualSha = (Get-FileHash -Algorithm SHA256 -Path $wrapperJarPath).Hash.ToLower()
            if ($actualSha -ne $expectedSha) {
                throw "gradle-wrapper.jar checksum mismatch for Gradle $gradleVersion (expected $expectedSha, got $actualSha)"
            }
            Write-Host "Verified gradle-wrapper.jar checksum ($actualSha)"

            Push-Location $serverName
            try {
                # Ensure gradlew is executable (git does not preserve the execute bit on Windows)
                if ($IsLinux -or $IsMacOS) {
                    & chmod +x gradlew
                }

                # Build the image
                # Use the commit timestamp as the image creation date so identical source
                # produces an identical image digest. Falls back to the build.gradle default
                # (a fixed epoch) when git or commit metadata is unavailable.
                $gradleArgs = @("bootBuildImage", "--imageName=$ImageNameWithTag")
                if (Get-Command git -ErrorAction SilentlyContinue) {
                    $createdDate = (& git -C $ImagesDirectory show -s --format=%cI HEAD 2>$null)
                    if ($LASTEXITCODE -eq 0 -and $createdDate) {
                        $gradleArgs += "-PimageCreatedDate=$($createdDate.Trim())"
                    }
                }
                if ($env:GITHUB_ACTIONS -eq "true") {
                    $gradleArgs += "--no-daemon"
                }

                ./gradlew @gradleArgs
            }
            finally {
                Pop-Location
            }
        }
        finally {
            Pop-Location  # workspace
        }
    }

    if ($SmokeTest) {
        $resolvedTag = ($ImageNameWithTag -split ':')[-1]
        & "$ImagesDirectory/smoke-test.ps1" -Name $Name -Registry $DockerOrg -Tag $resolvedTag
    }
}
catch {
    Write-Error "Build failed: $_"
    exit 1
}