ci-build.yml

on:
  push:
    branches:
      - '**'
  pull_request:
    branches:
      - '**'
  workflow_call:
    inputs:
      latest:
        description: 'Tag image as latest'
        required: false
        type: boolean
        default: false
      push:
        description: 'Push image to registry (makes it push if it usually wouldnt)'
        required: false
        type: boolean
        default: false
  workflow_dispatch:

name: ci-build

env:
  REGISTRY: ghcr.io
  DOTNET_VERSION: 11.0.x

jobs:

  tests:
    name: Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '${{ env.DOTNET_VERSION }}'

      - name: Run tests
        run: |
          set -euo pipefail
          dotnet test -c Release --solution OpenShockBackend.slnx \
            --results-directory "artifacts/test-results" \
            -- \
            --report-trx \
            --report-trx-filename test-results.trx

      - name: Upload test artifacts
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: test-results
          path: artifacts/test-results
          if-no-files-found: warn

  # Each image builds on a runner matching its own architecture (no QEMU) and pushes an untagged
  # image by digest. `merge` then stitches each image's digests into one multi-arch tag.
  build:
    name: Build (${{ matrix.image.name }} / ${{ matrix.platform.name }})
    runs-on: ${{ matrix.platform.runner }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        image:
          - name: api
            dockerfile: docker/API.Dockerfile
          - name: live-control-gateway
            dockerfile: docker/LiveControlGateway.Dockerfile
          - name: cron
            dockerfile: docker/Cron.Dockerfile
        platform:
          - name: linux/amd64
            runner: ubuntu-latest
          - name: linux/arm64
            runner: ubuntu-24.04-arm
    env:
      PUSH_IMAGE: ${{ inputs.push || (github.ref_protected && github.event_name != 'pull_request') }}
    outputs:
      push-image: ${{ env.PUSH_IMAGE }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build ${{ matrix.image.name }}
        uses: ./.github/actions/build-app
        with:
          dockerfile: ${{ matrix.image.dockerfile }}
          image: ${{ matrix.image.name }}
          platform: ${{ matrix.platform.name }}
          push: ${{ env.PUSH_IMAGE }}
          registry: ${{ env.REGISTRY }}
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}

  merge:
    name: Merge (${{ matrix.image }})
    needs: [build]
    runs-on: ubuntu-latest
    if: needs.build.outputs.push-image == 'true'
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        image: [api, live-control-gateway, cron]

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Merge ${{ matrix.image }}
        uses: ./.github/actions/merge-image
        with:
          registry: ${{ env.REGISTRY }}
          image: ${{ matrix.image }}
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}
          latest: ${{ inputs.latest || false }}

  # Deploys reference the commit SHA tag. It is derived from the commit alone, so re-running a
  # single job produces the same tag instead of pointing at an image that was never built.
  deploy-prod-workflow:
    runs-on: ubuntu-latest
    needs: merge
    if: ${{ github.ref_type == 'branch' && github.event_name != 'pull_request' && github.ref_name == 'master' }}
    environment: production
    steps:
      - name: Send repository dispatch
        uses: OpenShock/actions/repository-dispatch@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
        with:
          repo: openshock/kubernetes-cluster-gitops
          event-type: update-backend-prod
          client-payload: |
            {"tag": "${{ github.sha }}"}
          token: ${{ secrets.GITOPS_PAT }}

  deploy-staging:
    runs-on: ubuntu-latest
    needs: merge
    if: ${{ github.ref_type == 'branch' && github.event_name != 'pull_request' && github.ref_name == 'develop' }}
    environment: staging

    steps:
      - name: Send repository dispatch
        uses: OpenShock/actions/repository-dispatch@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
        with:
          repo: openshock/kubernetes-cluster-gitops
          event-type: update-backend-staging
          client-payload: |
            {"tag": "${{ github.sha }}"}
          token: ${{ secrets.GITOPS_PAT }}

  deploy-dev:
    runs-on: ubuntu-latest
    needs: merge
    if: ${{ github.ref_type == 'branch' && github.event_name != 'pull_request' && github.ref_name == 'develop' }}
    environment: development

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            .github

      - uses: ./.github/actions/watchtower-update
        with:
          url: ${{ vars.WATCHTOWER_URL }}
          token: ${{ secrets.WATCHTOWER_TOKEN }}