cd.yml

name: CD - Build and Deploy

on:
  push:
    branches:
      - main #production
      - dev #staging
      - prod #real deployment
      - feature/no-issue/add-cd-workflow
  pull_request:
    branches:
      - main
      - dev
      - prod
  workflow_dispatch: # Allow manual trigger

env:
  REGISTRY: docker.io
  IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/taskgenix-be

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      pull-requests: write # bot to comment on PR

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Create Firebase service account file
        env:
          FIREBASE_SERVICE_ACCOUNT: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
        run: |
          echo "$FIREBASE_SERVICE_ACCOUNT" > firebase-service-account.json

          # Verify the file is valid JSON
          if ! jq . firebase-service-account.json >/dev/null 2>&1; then
            echo "❌ Error: firebase-service-account.json is not valid JSON"
            cat firebase-service-account.json
            exit 1
          fi

          echo "✅ Firebase service account file created successfully"
          ls -lh firebase-service-account.json

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Generate image tags
        id: tags
        run: |
          BRANCH_NAME=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
          SHORT_SHA=$(git rev-parse --short HEAD)

          # Sanitize branch name for Docker tag (replace / with -)
          SAFE_BRANCH=$(echo "$BRANCH_NAME" | sed 's/\//-/g')

          echo "branch=${SAFE_BRANCH}" >> $GITHUB_OUTPUT
          echo "sha=${SHORT_SHA}" >> $GITHUB_OUTPUT

          # Build tags
          TAGS="${{ env.IMAGE_NAME }}:latest"
          TAGS="${TAGS},${{ env.IMAGE_NAME }}:${SAFE_BRANCH}"
          TAGS="${TAGS},${{ env.IMAGE_NAME }}:${SAFE_BRANCH}-${SHORT_SHA}"

          echo "tags=${TAGS}" >> $GITHUB_OUTPUT

          echo "Generated tags:"
          echo "$TAGS" | tr ',' '\n'

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile.prod
          platforms: linux/amd64
          # Push only on push branch event, PR only build
          push: ${{ github.event_name != 'pull_request' }}
          # Take the generated tags from previous step
          tags: ${{ steps.tags.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          secret-files: |
            firebase_service_account=./firebase-service-account.json

      - name: Comment on PR with build info
        if: github.event_name == 'pull_request'
        uses: marocchino/sticky-pull-request-comment@v2.9.4
        with:
          header: build-status
          message: |
            ## 🐳 Docker Build Complete

            **Image would be tagged as:**
            - `${{ env.IMAGE_NAME }}:latest`
            - `${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.branch }}`
            - `${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.branch }}-${{ steps.tags.outputs.sha }}`

            ** Tag explanations:**
            - latest - Always points to the most recent build (easy to pull)
            - {branch-name} - Tracks the specific branch (e.g., main, dev, feature-no-issue-add-cd-workflow)
            - {branch-name}-{short-sha} - Unique identifier for this exact commit

            ** Example: **
            - lcaohoanq/taskgenix-be:latest
            - lcaohoanq/taskgenix-be:feature-no-issue-add-cd-workflow
            - lcaohoanq/taskgenix-be:feature-no-issue-add-cd-workflow-a1b2c3d

            **Note:** Image is built but not pushed for pull requests.

            📦 [View on Docker Hub](https://hub.docker.com/repository/docker/lcaohoanq/taskgenix-be)

      - name: Image digest
        if: github.event_name != 'pull_request'
        run: echo ${{ steps.build.outputs.digest }}

      - name: Clean up sensitive files
        if: always()
        run: |
          rm -f firebase-service-account.json
          echo "🧹 Cleaned up sensitive files"

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' && (github.ref == 'refs/heads/prod' || github.ref == 'refs/heads/staging')

    steps:
      - name: Deploy to staging (staging branch)
        if: github.ref == 'refs/heads/staging'
        run: |
          echo "🚀 Deploying to staging environment..."
          # Example: docker pull ${{ env.IMAGE_NAME }}:staging && docker-compose -f docker-compose.staging.yml up -d

      - name: Deploy to production (prod branch)
        if: github.ref == 'refs/heads/prod'
        run: |
          echo "🚀 Deploying to production environment..."
          # Example: docker pull ${{ env.IMAGE_NAME }}:latest && docker-compose -f docker-compose.prod.yml up -d

  notify:
    needs: [build-and-push, deploy]
    runs-on: ubuntu-latest
    if: always()
    permissions:
      pull-requests: write # bot to comment on PR

    steps:
      - name: Comment on PR - Success
        if: github.event_name == 'pull_request' && needs.build-and-push.result == 'success'
        uses: marocchino/sticky-pull-request-comment@v2.9.4
        with:
          header: build-result
          message: |
            ## ✅ Build Successful!

            Your changes have been built successfully.

            📦 [View on Docker Hub](https://hub.docker.com/repository/docker/lcaohoanq/taskgenix-be)

      - name: Comment on PR - Failure
        if: github.event_name == 'pull_request' && needs.build-and-push.result == 'failure'
        uses: marocchino/sticky-pull-request-comment@v2.9.4
        with:
          header: build-result
          message: |
            ## ❌ Build Failed!

            Please check the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.

      - name: Notify push success
        if: github.event_name == 'push' && needs.build-and-push.result == 'success'
        run: |
          echo "✅ Build and push successful!"
          echo "Image: ${{ env.IMAGE_NAME }}:latest"
          # Add notification logic here (Slack, Discord, Email, etc.)

      - name: Notify push failure
        if: github.event_name == 'push' && needs.build-and-push.result == 'failure'
        run: |
          echo "❌ Build and push failed!"
          # Add failure notification logic here