name: Publish Docker Images

on:
  push:
    branches:
      - main
    # Only rebuild images when something that affects them changes (not docs-only
    # commits). Tag pushes and manual dispatch always run.
    paths:
      - "apps/api/**"
      - "apps/dashboard/**"
      - "apps/jobs/**"
      - "packages/**"
      - "docker/**"
      - "pnpm-lock.yaml"
      - ".github/workflows/docker-publish.yml"
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version tag (e.g., v1.0.0)"
        required: false
        default: "latest"

concurrency:
  group: docker-publish-${{ github.ref }}
  cancel-in-progress: true

env:
  DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME || 'classroomio' }}

jobs:
  # Boot each freshly built image against ephemeral postgres + redis and confirm it
  # actually starts BEFORE we publish anything. A broken image never reaches users.
  smoke:
    name: Smoke test (${{ matrix.name }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        include:
          - name: api
            dockerfile: ./docker/Dockerfile.api
            image: api
          - name: dashboard
            dockerfile: ./docker/Dockerfile.dashboard
            image: dashboard
          - name: jobs
            dockerfile: ./docker/Dockerfile.jobs
            image: jobs
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: classroomio
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 5s --health-retries 15
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping" --health-interval 5s --health-timeout 5s --health-retries 10
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build amd64 image (load locally)
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          load: true
          tags: cio-smoke-${{ matrix.image }}:test
          platforms: linux/amd64
          cache-from: type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/${{ matrix.image }}:buildcache

      - name: Boot smoke test
        run: bash docker/smoke-test.sh ${{ matrix.name }} cio-smoke-${{ matrix.image }}:test

  build-and-push:
    needs: smoke
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - name: api
            dockerfile: ./docker/Dockerfile.api
            image: api
          - name: dashboard
            dockerfile: ./docker/Dockerfile.dashboard
            image: dashboard
          - name: jobs
            dockerfile: ./docker/Dockerfile.jobs
            image: jobs

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        # Required to build linux/arm64 on an amd64 runner.
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.DOCKERHUB_USERNAME }}/${{ matrix.image }}
          # Tag policy (stable-releases + edge):
          #   git tag v1.4.2  -> 1.4.2, 1.4, 1, latest   (a real, stable release)
          #   push to main     -> edge only               (latest is NEVER moved by a merge)
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
            type=raw,value=edge,enable={{is_default_branch}}

      - name: Build and push ${{ matrix.name }}
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/${{ matrix.image }}:buildcache
          cache-to: type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/${{ matrix.image }}:buildcache,mode=max
          platforms: linux/amd64,linux/arm64

      - name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}