add api build pipeline

Author: jsbroks

.github/workflows/apps-api.yaml

@@ -0,0 +1,80 @@
+name: Apps / API
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: ["*"]
+    paths:
+      - apps/api/**
+      - packages/**
+      - .github/workflows/apps-api.yaml
+      - pnpm-lock.yaml
+  push:
+    branches: ["main"]
+    paths:
+      - apps/api/**
+      - packages/**
+      - .github/workflows/apps-api.yaml
+      - pnpm-lock.yaml
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    strategy:
+      matrix:
+        platform: [linux/amd64]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Check if Docker Hub secrets are available
+        run: |
+          if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
+            echo "DOCKERHUB_LOGIN=false" >> $GITHUB_ENV
+          else
+            echo "DOCKERHUB_LOGIN=true" >> $GITHUB_ENV
+          fi
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        if: env.DOCKERHUB_LOGIN == 'true'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ctrlplane/api
+          tags: |
+            type=sha,format=short,prefix=
+
+      - name: Build
+        uses: docker/build-push-action@v6
+        if: github.ref != 'refs/heads/main'
+        with:
+          push: false
+          file: apps/api/Dockerfile
+          platforms: ${{ matrix.platform }}
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Build and Push
+        uses: docker/build-push-action@v6
+        if: github.ref == 'refs/heads/main' && env.DOCKERHUB_LOGIN == 'true'
+        with:
+          push: true
+          file: apps/api/Dockerfile
+          platforms: ${{ matrix.platform }}
+          tags: ${{ steps.meta.outputs.tags }}

apps/api/Dockerfile

@@ -1,7 +1,9 @@
 ARG NODE_VERSION=22
 FROM node:${NODE_VERSION}-alpine
 
-RUN apk add --no-cache libc6-compat python3 make g++ bash nano
+FROM base AS builder
+
+RUN apk add --no-cache libc6-compat python3 make g++
 
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
@@ -10,6 +12,8 @@ RUN npm install -g turbo
 RUN npm install -g corepack@latest
 RUN corepack enable pnpm
 
+FROM builder AS installer
+
 WORKDIR /app
 
 COPY .gitignore .gitignore
@@ -19,34 +23,45 @@ RUN pnpm add -g turbo
 COPY package.json package.json
 COPY pnpm-*.yaml .
 
+COPY tooling/tailwind/package.json ./tooling/tailwind/package.json
 COPY tooling/prettier/package.json ./tooling/prettier/package.json
 COPY tooling/eslint/package.json ./tooling/eslint/package.json
-COPY tooling/typescript/package.json ./tooling/typescript/package.json
+COPY tooling/typescript ./tooling/typescript
 
+COPY packages/trpc/package.json ./packages/trpc/package.json
+COPY packages/auth/package.json ./packages/auth/package.json
 COPY packages/db/package.json ./packages/db/package.json
 COPY packages/validators/package.json ./packages/validators/package.json
-COPY packages/secrets/package.json ./packages/secrets/package.json
-COPY packages/auth/package.json ./packages/auth/package.json
-COPY packages/logger/package.json ./packages/logger/package.json
 COPY packages/job-dispatch/package.json ./packages/job-dispatch/package.json
+COPY packages/logger/package.json ./packages/logger/package.json
+COPY packages/secrets/package.json ./packages/secrets/package.json
 COPY packages/events/package.json ./packages/events/package.json
 COPY packages/rule-engine/package.json ./packages/rule-engine/package.json
 COPY packages/workspace-engine-sdk/package.json ./packages/workspace-engine-sdk/package.json
 
-COPY apps/pty-proxy/package.json ./apps/pty-proxy/package.json
+COPY apps/api/package.json ./apps/api/package.json
 
 RUN pnpm install --frozen-lockfile
 
 COPY . .
 
-RUN turbo build --filter=...@ctrlplane/pty-proxy
+RUN turbo build --filter=...@ctrlplane/api
+
+FROM base AS runner
+WORKDIR /app
 
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nodejs
 USER nodejs
 
+COPY --from=installer --chown=nodejs:nodejs /app/apps/api/dist ./apps/api/dist
+
+EXPOSE 8081
+
 ENV NODE_ENV=production
+ENV HOSTNAME=0.0.0.0
+ENV AUTH_TRUST_HOST=true
 
-WORKDIR /app/apps/pty-proxy/dist/
+WORKDIR /app/apps/api/dist/
 
-CMD ["node", "index.js"]
+CMD ["node", "apps/api/dist/index.js"]