scrum-poker-internal/.github/workflows/ci_cd.yml

name: CI/CD

on:
  push:
  pull_request:

permissions:
  contents: read

env:
  REGISTRY: git.twyco.de

jobs:
  test_and_check_app:
    name: test_and_check_app
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Run required application checks
        uses: ./.github/tests/test_and_check_app

  publish:
    name: Publish immutable image
    if: >-
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
    needs:
      - test_and_check_app
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0

      - name: Validate ref and calculate image name
        id: image
        shell: bash
        run: |
          set -Eeuo pipefail

          image_path="$(printf '%s' "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')"
          image="${REGISTRY}/${image_path}"

          case "${GITHUB_REF}" in
            refs/heads/main)
              printf -v run_attempt '%03d' "${GITHUB_RUN_ATTEMPT}"
              tag="main-${GITHUB_RUN_NUMBER}-${run_attempt}-${GITHUB_SHA:0:12}"
              environment="staging"
              vite_app_version="main-${GITHUB_SHA:0:12}"
              vite_reverb_app_key="1af96b48d2ef78983e4ef281eed3a48b"
              vite_reverb_host="scrum-poker.twyco-staging.de"
              ;;
            refs/tags/*)
              tag="${GITHUB_REF#refs/tags/}"

              if [[ ! "${tag}" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
                echo "Production tags must match vMAJOR.MINOR.PATCH." >&2
                exit 1
              fi

              git fetch --no-tags origin main:refs/remotes/origin/main

              if ! git merge-base --is-ancestor "${GITHUB_SHA}" origin/main; then
                echo "Production tag must point to a commit contained in main." >&2
                exit 1
              fi

              environment="production"
              vite_app_version="${tag}"
              vite_reverb_app_key="cfd9d925ff339374c04997beb90fbc32"
              vite_reverb_host="scrum-poker.petsch-studios.de"
              ;;
            *)
              echo "Unsupported ref: ${GITHUB_REF}" >&2
              exit 1
              ;;
          esac

          {
            echo "image=${image}"
            echo "tag=${tag}"
            echo "environment=${environment}"
            echo "vite_app_version=${vite_app_version}"
            echo "vite_reverb_app_key=${vite_reverb_app_key}"
            echo "vite_reverb_host=${vite_reverb_host}"
          } >> "${GITHUB_OUTPUT}"

      - name: Log in to private registry
        shell: bash
        env:
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -Eeuo pipefail

          if [[ -z "${REGISTRY_USERNAME}" || -z "${REGISTRY_TOKEN}" ]]; then
            echo "Registry credentials are missing." >&2
            exit 1
          fi

          printf '%s' "${REGISTRY_TOKEN}" |
            docker login \
              --username "${REGISTRY_USERNAME}" \
              --password-stdin \
              "${REGISTRY}"

      - name: Build and publish runtime image
        shell: bash
        env:
          IMAGE: ${{ steps.image.outputs.image }}
          IMAGE_TAG: ${{ steps.image.outputs.tag }}
          DEPLOYMENT_ENVIRONMENT: ${{ steps.image.outputs.environment }}
          VITE_APP_VERSION: ${{ steps.image.outputs.vite_app_version }}
          VITE_REVERB_APP_KEY: ${{ steps.image.outputs.vite_reverb_app_key }}
          VITE_REVERB_HOST: ${{ steps.image.outputs.vite_reverb_host }}
          VITE_REVERB_PORT: "443"
          VITE_REVERB_SCHEME: https
        run: |
          set -Eeuo pipefail

          if [[ "${DEPLOYMENT_ENVIRONMENT}" == "production" ]] &&
            docker buildx imagetools inspect "${IMAGE}:${IMAGE_TAG}" >/dev/null 2>&1; then
            echo "Production image ${IMAGE}:${IMAGE_TAG} already exists and will not be overwritten." >&2
            exit 1
          fi

          docker buildx build \
            --file Dockerfile \
            --target runtime \
            --build-arg "VITE_APP_VERSION=${VITE_APP_VERSION}" \
            --build-arg "VITE_REVERB_APP_KEY=${VITE_REVERB_APP_KEY}" \
            --build-arg "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
            --build-arg "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \
            --build-arg "VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}" \
            --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
            --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
            --label "de.twyco.environment=${DEPLOYMENT_ENVIRONMENT}" \
            --tag "${IMAGE}:${IMAGE_TAG}" \
            --push \
            .

      - name: Remove registry credentials
        if: ${{ always() }}
        shell: bash
        run: docker logout "${REGISTRY}" >/dev/null 2>&1 || true