ci: split FPM and FrankenPHP builds

.github/action/build-bake-publish/action.yml

@@ -1,10 +1,12 @@
 name: 'Build and Publish'
-description: 'Builds Image and pushes'
+description: 'Builds and publishes one PHP minor image family using Namespace'
 inputs:
-  targets:
-    description: 'Targets'
+  php-version:
+    description: 'PHP minor version to build'
+    required: true
+  family:
+    description: 'Image family: fpm or frankenphp'
     required: true
-    default: ''
   docker_hub_username:
     description: 'Docker Hub username'
     required: true
@@ -17,28 +19,94 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Validate image family
+      shell: bash
+      env:
+        FAMILY: ${{ inputs.family }}
+      run: |
+        case "$FAMILY" in
+          fpm|frankenphp) ;;
+          *) echo "Unsupported image family: $FAMILY" >&2; exit 1 ;;
+        esac
+
     - name: Install and configure Namespace CLI
-      uses: namespacelabs/nscloud-setup@v0
+      uses: namespacelabs/nscloud-setup@v0.0.12
 
     - name: Configure Namespace powered Buildx
-      uses: namespacelabs/nscloud-setup-buildx-action@v0
+      uses: namespacelabs/nscloud-setup-buildx-action@v0.0.23
 
     - name: Login into Docker Hub
       shell: bash
-      run: echo "${{ inputs.docker_hub_password }}" | docker login -u ${{ inputs.docker_hub_username }} --password-stdin
+      env:
+        DOCKER_HUB_USERNAME: ${{ inputs.docker_hub_username }}
+        DOCKER_HUB_PASSWORD: ${{ inputs.docker_hub_password }}
+      run: printf '%s' "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USERNAME" --password-stdin
 
     - name: Login into Github Docker Registry
       shell: bash
-      run: echo "${{ inputs.github_token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}
+      run: printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+
+    - name: Build and push base images
+      uses: docker/bake-action@v7.5.0
+      with:
+        push: true
+        files: |
+          docker-bake.hcl
+          docker-bake.${{ inputs.family }}.hcl
+        targets: ${{ inputs.family }}
+      env:
+        DOCKER_BUILD_RECORD_UPLOAD: false
+        DOCKER_BUILD_SUMMARY: false
+        phpMinor: ${{ inputs.php-version }}
+        imageSuffix: ${{ github.event_name == 'pull_request' && '-ci-test' || '' }}
+        tagPrefix: ${{ github.event_name == 'pull_request' && format('{0}-', github.event.number) || '' }}
+
+    # Derived targets reuse internal build stages, excluding the final OS upgrade.
+    - name: Build and push OpenTelemetry and webserver images
+      uses: docker/bake-action@v7.5.0
+      with:
+        push: true
+        files: |
+          docker-bake.hcl
+          docker-bake.${{ inputs.family }}.hcl
+        targets: ${{ inputs.family == 'fpm' && 'fpm-otel,caddy,nginx' || 'frankenphp-otel' }}
+      env:
+        DOCKER_BUILD_RECORD_UPLOAD: false
+        DOCKER_BUILD_SUMMARY: false
+        phpMinor: ${{ inputs.php-version }}
+        imageSuffix: ${{ github.event_name == 'pull_request' && '-ci-test' || '' }}
+        tagPrefix: ${{ github.event_name == 'pull_request' && format('{0}-', github.event.number) || '' }}
+
+    - name: Build and push OpenTelemetry webserver images
+      if: inputs.family == 'fpm'
+      uses: docker/bake-action@v7.5.0
+      with:
+        push: true
+        files: |
+          docker-bake.hcl
+          docker-bake.fpm.hcl
+        targets: caddy-otel,nginx-otel
+      env:
+        DOCKER_BUILD_RECORD_UPLOAD: false
+        DOCKER_BUILD_SUMMARY: false
+        phpMinor: ${{ inputs.php-version }}
+        imageSuffix: ${{ github.event_name == 'pull_request' && '-ci-test' || '' }}
+        tagPrefix: ${{ github.event_name == 'pull_request' && format('{0}-', github.event.number) || '' }}
 
-    - name: Build and push
-      uses: docker/bake-action@v6
+    - name: Build and push dev images
+      if: inputs.family == 'fpm'
+      uses: docker/bake-action@v7.5.0
       with:
         push: true
-        targets: ${{ inputs.targets }}
-        no-cache: true
+        files: |
+          docker-bake.hcl
+          docker-bake.fpm.hcl
+        targets: caddy-dev,nginx-dev
       env:
         DOCKER_BUILD_RECORD_UPLOAD: false
         DOCKER_BUILD_SUMMARY: false
+        phpMinor: ${{ inputs.php-version }}
         imageSuffix: ${{ github.event_name == 'pull_request' && '-ci-test' || '' }}
         tagPrefix: ${{ github.event_name == 'pull_request' && format('{0}-', github.event.number) || '' }}

.github/action/test-webserver/action.yml

@@ -0,0 +1,53 @@
+name: Test webserver image
+description: Run the example Shopware application against a published image
+inputs:
+  php-version:
+    description: PHP minor version to test
+    required: true
+  webserver:
+    description: Webserver to test
+    required: true
+runs:
+  using: composite
+  steps:
+    # Application containers run on this runner, not the remote Namespace builder.
+    - name: Set up local Docker Buildx
+      uses: docker/setup-buildx-action@v4.4.1
+
+    - name: Checkout example repository
+      uses: actions/checkout@v7.0.1
+      with:
+        repository: shopwareLabs/example-docker-repository
+        path: .smoke-test
+
+    - name: Build and test application
+      shell: bash
+      working-directory: .smoke-test
+      env:
+        BASE_IMAGE: ghcr.io/shopware/docker-base${{ github.event_name == 'pull_request' && '-ci-test' || '' }}:${{ github.event_name == 'pull_request' && format('{0}-', github.event.number) || '' }}${{ inputs.php-version }}-${{ inputs.webserver }}
+      run: |
+        # Always collect logs and remove test containers/volumes before the next server.
+        cleanup() {
+          set +e
+          docker compose -p image-smoke-test logs
+          docker compose -p image-smoke-test down --volumes
+        }
+        trap cleanup EXIT
+
+        docker compose -p image-smoke-test build --build-arg BASE_IMAGE="$BASE_IMAGE"
+        docker compose -p image-smoke-test up -d --wait
+
+        attempt_counter=0
+        max_attempts=5
+        until curl --output /dev/null --silent --head --fail localhost:8000/admin; do
+          if [ "$attempt_counter" -eq "$max_attempts" ]; then
+            echo "Max attempts reached"
+            exit 1
+          fi
+          printf '.'
+          attempt_counter=$((attempt_counter+1))
+          sleep 5
+        done
+
+        curl --fail localhost:8000/admin
+        curl --fail localhost:8000

.github/workflows/actions.lock

@@ -0,0 +1,108 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build-fpm.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'docker/bake-action@v7.5.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+        - 'jaxxstorm/action-install-gh-release@v3.0.0'
+        - 'namespacelabs/nscloud-setup-buildx-action@v0.0.23'
+        - 'namespacelabs/nscloud-setup@v0.0.12'
+    '.github/workflows/build-frankenphp.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'docker/bake-action@v7.5.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+        - 'namespacelabs/nscloud-setup-buildx-action@v0.0.23'
+        - 'namespacelabs/nscloud-setup@v0.0.12'
+    '.github/workflows/cleanup.yml':
+        - 'dataaxiom/ghcr-cleanup-action@v1.2.2'
+    '.github/workflows/hub.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'peter-evans/dockerhub-description@v5.0.0'
+    '.github/workflows/lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'hadolint/hadolint-action@v3.5.0'
+    '.github/workflows/security.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'crazy-max/ghaction-container-scan@v4.1.0'
+        - 'github/codeql-action@v4.39.1'
+    '.github/workflows/shell-lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'ludeeus/action-shellcheck@2.0.0'
+    '.github/workflows/update-php-matrix.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'octo-sts/action@v1.1.1'
+        - 'peter-evans/create-pull-request@v8.1.1'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'crazy-max/ghaction-container-scan@v4.1.0':
+        ref: 'v4.1.0'
+        commit: 'sha1-ffcba8deb5cb3531954cbedbbcd0179d79edf510'
+        owner_id: 1951866
+        repo_id: 414171338
+    'dataaxiom/ghcr-cleanup-action@v1.2.2':
+        ref: 'v1.2.2'
+        commit: 'sha1-d52806a0dc70b430571a37da1fde39733ffd640f'
+        owner_id: 131044173
+        repo_id: 799711900
+    'docker/bake-action@v7.5.0':
+        ref: 'v7.5.0'
+        commit: 'sha1-59cb1203cd42bcefd40a1b6d73b589e48c86040e'
+        owner_id: 5429470
+        repo_id: 301684204
+    'docker/setup-buildx-action@v4.4.1':
+        ref: 'v4.4.1'
+        commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069'
+        owner_id: 5429470
+        repo_id: 288485773
+    'github/codeql-action@v4.39.1':
+        ref: 'v4.39.1'
+        commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370'
+        owner_id: 9919
+        repo_id: 259445878
+    'hadolint/hadolint-action@v3.5.0':
+        ref: 'v3.5.0'
+        commit: 'sha1-06be81baf89a55ffd0e24b8f04a4185738dd3387'
+        owner_id: 34047791
+        repo_id: 212438777
+    'jaxxstorm/action-install-gh-release@v3.0.0':
+        ref: 'v3.0.0'
+        commit: 'sha1-25e24d2d23ae098373794ef1d6faecb48ee52da8'
+        owner_id: 1622940
+        repo_id: 265029375
+    'ludeeus/action-shellcheck@2.0.0':
+        ref: '2.0.0'
+        commit: 'sha1-00cae500b08a931fb5698e11e79bfbd38e612a38'
+        owner_id: 15093472
+        repo_id: 174679242
+    'namespacelabs/nscloud-setup-buildx-action@v0.0.23':
+        ref: 'v0.0.23'
+        commit: 'sha1-d059ed7184f0bc7c8b27e8810cea153d02bcc6dd'
+        owner_id: 90391633
+        repo_id: 613929575
+    'namespacelabs/nscloud-setup@v0.0.12':
+        ref: 'v0.0.12'
+        commit: 'sha1-df198f982fcecfb8264bea3f1274b56a61b6dfdc'
+        owner_id: 90391633
+        repo_id: 610758328
+    'octo-sts/action@v1.1.1':
+        ref: 'v1.1.1'
+        commit: 'sha1-f603d3be9d8dd9871a265776e625a27b00effe05'
+        owner_id: 160145231
+        repo_id: 749429568
+    'peter-evans/create-pull-request@v8.1.1':
+        ref: 'v8.1.1'
+        commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+        owner_id: 18365890
+        repo_id: 197176365
+    'peter-evans/dockerhub-description@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-1b9a80c056b620d92cedb9d9b5a223409c68ddfa'
+        owner_id: 18365890
+        repo_id: 193685475

.github/workflows/build-fpm.yml

@@ -0,0 +1,111 @@
+name: Build FPM Images
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docker-bake.hcl'
+      - 'docker-bake.fpm.hcl'
+      - '.github/workflows/build-fpm.yml'
+      - '.github/action/test-webserver/**'
+      - '.github/action/build-bake-publish/**'
+      - 'fpm/**'
+      - 'fpm-otel/**'
+      - 'caddy/**'
+      - 'nginx/**'
+      - 'dev/**'
+  pull_request:
+    paths:
+      - 'docker-bake.hcl'
+      - 'docker-bake.fpm.hcl'
+      - '.github/workflows/build-fpm.yml'
+      - '.github/action/test-webserver/**'
+      - '.github/action/build-bake-publish/**'
+      - 'fpm/**'
+      - 'fpm-otel/**'
+      - 'caddy/**'
+      - 'nginx/**'
+      - 'dev/**'
+  schedule:
+    - cron: '10 4 * * *'
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+jobs:
+  prepare:
+    name: PHP versions
+    runs-on: ubuntu-26.04
+    outputs:
+      versions: ${{ steps.php-versions.outputs.versions }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.4.1
+
+      - name: Read PHP versions from Bake
+        id: php-versions
+        run: |
+          versions=$(docker buildx bake -f docker-bake.hcl -f docker-bake.fpm.hcl --print fpm | jq -c '.group["fpm"].targets | map(ltrimstr("fpm-") | gsub("-"; "."))')
+          echo "versions=$versions" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: PHP ${{ matrix.php-version }}
+    needs: [prepare]
+    runs-on: ubuntu-26.04
+    strategy:
+      fail-fast: false
+      matrix:
+        php-version: ${{ fromJSON(needs.prepare.outputs.versions) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+
+      - name: Build and publish FPM images
+        uses: $/.github/action/build-bake-publish
+        with:
+          php-version: ${{ matrix.php-version }}
+          family: fpm
+          docker_hub_username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          docker_hub_password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Test Caddy image
+        if: matrix.php-version == '8.3'
+        uses: $/.github/action/test-webserver
+        with:
+          php-version: ${{ matrix.php-version }}
+          webserver: caddy
+
+      - name: Test Nginx image
+        if: matrix.php-version == '8.3'
+        uses: $/.github/action/test-webserver
+        with:
+          php-version: ${{ matrix.php-version }}
+          webserver: nginx
+
+      - name: Install container structure test
+        if: matrix.php-version == '8.4'
+        uses: jaxxstorm/action-install-gh-release@v3.0.0
+        with:
+          repo: GoogleContainerTools/container-structure-test
+          extension-matching: disable
+          rename-to: container-structure-test
+          chmod: 0755
+
+      - name: Test dev image
+        if: matrix.php-version == '8.4'
+        env:
+          IMAGE_TAG: ghcr.io/shopware/docker-dev${{ github.event_name == 'pull_request' && '-ci-test' || '' }}:${{ github.event_name == 'pull_request' && format('{0}-', github.event.number) || '' }}php${{ matrix.php-version }}-node24-caddy
+        run: |
+          docker pull "$IMAGE_TAG"
+          container-structure-test test --config dev/config.yaml --image "$IMAGE_TAG"