docker-build-push.yml

# Auto-triggered on merge to `test`. Builds changed service images, pushes to
# ghcr.io, then updates image tags in icipe-official/VA-Cube-Configs.
#
# Repository secrets used by this workflow:
#   GITHUB_TOKEN       - auto-provided by Actions; do not set manually
#   TOKEN_KEY_UAT      - baked into the `ui` image at build time as
#                        NEXT_PUBLIC_TOKEN_KEY. Rotating requires a UI rebuild.
#   REPO_ACCESS_TOKEN  - PAT with contents:write on icipe-official/VA-Cube-Configs.
#                        Used by the update-configs job to push the image-tag commit.
#
# Edit secrets at: Settings -> Secrets and variables -> Actions.
# Full reference + rotation steps: docs/SMG/08-deployment.md
#   ("Managing the test/UAT secrets").

name: Build and Push Docker Images

on:
  push:
    branches:
      - test
      - main
  pull_request:
    types: [closed]
    branches:
      - test
      - main
  workflow_dispatch:
    inputs:
      branch:
        description: "Branch to check for changes"
        required: true
        default: "test"
      services:
        description: 'Comma-separated list of services to build (e.g., ui,api,help,tileserver,umami,ingestionapi,nginx,occurrencegeojob) or "all"'
        required: true
        default: "all"

jobs:
  set-deployment-environment:
    name: Set the GitHub deployment environment to use based on git branch.
    runs-on: ubuntu-latest
    outputs:
      deployment_environment: ${{ steps.determine-env.outputs.deployment_environment }}
    steps:
      - id: determine-env
        run: |
          # For pull_request events, use base_ref (target branch)
          # For push events, use ref_name (current branch)
          # For workflow_dispatch, use the branch input
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            TARGET_BRANCH="${{ github.base_ref }}"
          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TARGET_BRANCH="${{ github.event.inputs.branch }}"
          else
            TARGET_BRANCH="${{ github.ref_name }}"
          fi

          if [ "$TARGET_BRANCH" = "main" ]; then
            echo "deployment_environment=production" >> $GITHUB_OUTPUT
          elif [ "$TARGET_BRANCH" = "test" ]; then
            echo "deployment_environment=test" >> $GITHUB_OUTPUT
          fi

  detect-changes:
    name: Detect changes for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment
    needs: set-deployment-environment
    runs-on: ubuntu-latest
    environment: ${{ needs.set-deployment-environment.outputs.deployment_environment }}
    outputs:
      changed_services: ${{ steps.detect-changes.outputs.changed_services }}
      api_changed: ${{ steps.detect-changes.outputs.api_changed }}
      ui_changed: ${{ steps.detect-changes.outputs.ui_changed }}
      occurrencegeojob_changed: ${{ steps.detect-changes.outputs.occurrencegeojob_changed }}
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set Diff Range
        id: diff-range
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.merged }}" == "true" ]]; then
            echo "HEAD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
            echo "BASE_SHA=$(git rev-parse HEAD^1)" >> $GITHUB_ENV
          else
            echo "HEAD_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
            echo "BASE_SHA=$(git rev-parse HEAD^1)" >> $GITHUB_ENV
          fi

      - name: Detect Changed Services
        id: detect-changes
        run: |
          declare -A SERVICES=(
            ["ui"]="src/UI"
            ["api"]="src/API"
            ["help"]="src/Help"
            ["tileserver"]="src/TileServer"
            ["docker-umami"]="src/Docker/umami" # changed to docker-umami for avaialable public ghcr
            ["ingestionapi"]="src/IngestionAPI"
            ["nginx"]="src/Docker/nginx"
            ["occurrencegeojob"]="src/OccurrenceGeoJob"
          )
          CHANGED_SERVICES=""
          API_CHANGED="false"
          UI_CHANGED="false"
          OCCURRENCEGEOJOB_CHANGED="false"

          for service in "${!SERVICES[@]}"; do
            if git diff --name-only "$BASE_SHA" "$HEAD_SHA" | grep -q "^${SERVICES[$service]}/"; then
              CHANGED_SERVICES+="$service,"
              if [[ "$service" == "api" ]]; then API_CHANGED="true"; fi
              if [[ "$service" == "ui" ]]; then UI_CHANGED="true"; fi
              if [[ "$service" == "occurrencegeojob" ]]; then OCCURRENCEGEOJOB_CHANGED="true"; fi
            fi
          done

          echo "changed_services=${CHANGED_SERVICES%,}" >> $GITHUB_OUTPUT
          echo "api_changed=$API_CHANGED" >> $GITHUB_OUTPUT
          echo "ui_changed=$UI_CHANGED" >> $GITHUB_OUTPUT
          echo "occurrencegeojob_changed=$OCCURRENCEGEOJOB_CHANGED" >> $GITHUB_OUTPUT

  api-ci:
    name: API CI for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment
    runs-on: ubuntu-latest
    needs: [set-deployment-environment, detect-changes]
    environment: ${{ needs.set-deployment-environment.outputs.deployment_environment }}
    if: |
      needs.detect-changes.outputs.api_changed == 'true' ||
      (
        github.event_name == 'workflow_dispatch' &&
        (
          contains(github.event.inputs.services, 'api') ||
          github.event.inputs.services == 'all'
        )
      )
    defaults:
      run:
        working-directory: src/API
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 22
          cache: "npm"
      - run: npm ci
      - run: npm run build
      - run: npm run lint

  ui-ci:
    name: UI CI for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment
    runs-on: ubuntu-latest
    needs: [set-deployment-environment, detect-changes]
    environment: ${{ needs.set-deployment-environment.outputs.deployment_environment }}
    if: |
      needs.detect-changes.outputs.ui_changed == 'true' ||
      (
        github.event_name == 'workflow_dispatch' &&
        (
          contains(github.event.inputs.services, 'ui') ||
          github.event.inputs.services == 'all'
        )
      )
    defaults:
      run:
        working-directory: src/UI
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 18
          cache: "npm"
      - run: npm ci
      - run: npm run build
      - run: npm run lint

  occurrencegeojob-ci:
    name: OccurrenceGeoJob CI for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment
    runs-on: ubuntu-latest
    needs: [set-deployment-environment, detect-changes]
    environment: ${{ needs.set-deployment-environment.outputs.deployment_environment }}
    if: |
      needs.detect-changes.outputs.occurrencegeojob_changed == 'true' ||
      (
        github.event_name == 'workflow_dispatch' &&
        (
          contains(github.event.inputs.services, 'occurrencegeojob') ||
          github.event.inputs.services == 'all'
        )
      )
    defaults:
      run:
        working-directory: src/OccurrenceGeoJob
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 20
          cache: "npm"
      - run: npm ci
      - run: npm run build
      - run: npm run lint

  build-and-push:
    name: Build and Push Docker Images for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment
    runs-on: ubuntu-latest
    environment: ${{ needs.set-deployment-environment.outputs.deployment_environment }}
    needs:
      [
        set-deployment-environment,
        detect-changes,
        api-ci,
        ui-ci,
        occurrencegeojob-ci,
      ]
    if: |
      always() &&
      (
        github.event_name == 'workflow_dispatch' ||
        needs.detect-changes.outputs.changed_services != ''
      ) &&
      (
        needs.api-ci.result != 'failure' &&
        needs.ui-ci.result != 'failure' &&
        needs.occurrencegeojob-ci.result != 'failure'
      )
    # --- ADD OR UPDATE THIS OUTPUTS SECTION ---
    outputs:
      short_sha: ${{ steps.build-push-step.outputs.short_sha }}
      built_services_with_sha: ${{ steps.build-push-step.outputs.built_services_with_sha }} # <--- NEW OUTPUT HERE
    # -------------------------------------------
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Determine SHA prefix based on environment
        id: sha-prefix
        run: |
          if [ "${{ needs.set-deployment-environment.outputs.deployment_environment }}" = "production" ]; then
            echo "SHA_PREFIX=production-" >> $GITHUB_OUTPUT
          elif [ "${{ needs.set-deployment-environment.outputs.deployment_environment }}" = "test" ]; then
            echo "SHA_PREFIX=test-" >> $GITHUB_OUTPUT
          else
            echo "SHA_PREFIX=" >> $GITHUB_OUTPUT
          fi

      - name: Build and Push Images
        id: build-push-step # Make sure this step has an ID
        run: |
          declare -A SERVICES=(
            ["ui"]="src/UI"
            ["api"]="src/API"
            ["help"]="src/Help"
            ["tileserver"]="src/TileServer"
            ["docker-umami"]="src/Docker/umami" # changed to docker-umami for avaialable public ghcr
            ["ingestionapi"]="src/IngestionAPI"
            ["nginx"]="src/Docker/nginx"
            ["occurrencegeojob"]="src/OccurrenceGeoJob"
          )

          SELECTED="${{ needs.detect-changes.outputs.changed_services }}"
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            SELECTED="${{ github.event.inputs.services }}"
            if [[ "$SELECTED" == "all" ]]; then
              SELECTED=$(IFS=','; echo "${!SERVICES[*]}" | tr ' ' ',')
            fi
          fi

          IFS=',' read -ra TO_BUILD <<< "$SELECTED"
          SHORT_SHA=$(git rev-parse --short HEAD)
          echo "Detected SHORT_SHA: $SHORT_SHA"
          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT # This exports the overall SHA

          # --- NEW LOGIC: Prepare output for built services and their SHAs ---
          BUILT_SERVICES_OUTPUT=""
          first_service=true

          cd src
          chmod +x buildVersionFiles.sh
          ./buildVersionFiles.sh
          cd ..

          # Get the SHA prefix based on environment
          SHA_PREFIX="${{ steps.sha-prefix.outputs.SHA_PREFIX }}"
          echo "Using SHA prefix: $SHA_PREFIX"

          for image_name in "${TO_BUILD[@]}"; do
            dir="${SERVICES[$image_name]}"
            echo "Building and pushing $image_name from $dir"
            LATEST_TAG="ghcr.io/${{ github.repository_owner }}/${image_name}:latest"
            PREFIXED_SHA="${SHA_PREFIX}${SHORT_SHA}"
            SHA_TAG="ghcr.io/${{ github.repository_owner }}/${image_name}:${PREFIXED_SHA}"
            if [[ "$image_name" == "ui" ]]; then
              docker build \
                --build-arg NEXT_PUBLIC_TOKEN_KEY="${{ secrets.TOKEN_KEY_UAT }}" \
                --build-arg NEXT_PUBLIC_AUTH_ENDPOINT="${{ secrets.NEXT_PUBLIC_AUTH_ENDPOINT }}" \
                --build-arg NEXT_PUBLIC_ANALYTICS_ID="${{ secrets.NEXT_PUBLIC_ANALYTICS_ID }}" \
                --build-arg NEXT_PUBLIC_ANALYTICS_URL="${{ secrets.NEXT_PUBLIC_ANALYTICS_URL }}" \
                --build-arg NEXT_PUBLIC_MAX_UPLOAD_SIZE="${{ secrets.NEXT_PUBLIC_MAX_UPLOAD_SIZE }}" \
                --no-cache \
                -t "$LATEST_TAG" -t "$SHA_TAG" "$dir"
            elif [[ "$image_name" == "docker-umami" ]]; then
              docker build \
                --build-arg BASE_PATH="${{ secrets.UMAMI_BUILD_ARG_BASE_PATH }}" \
                --no-cache \
                -t "$LATEST_TAG" -t "$SHA_TAG" "$dir"
            else
              docker build -t "$LATEST_TAG" -t "$SHA_TAG" "$dir"
            fi
            docker push "$LATEST_TAG"
            docker push "$SHA_TAG"
            
            # Append to output string in 'service_name:sha' format with prefix
            if [ "$first_service" = true ]; then
              BUILT_SERVICES_OUTPUT+="${image_name}:${PREFIXED_SHA}"
              first_service=false
            else
              BUILT_SERVICES_OUTPUT+=",${image_name}:${PREFIXED_SHA}"
            fi
          done

          # Export the list of built services and their specific SHAs
          echo "built_services_with_sha=$BUILT_SERVICES_OUTPUT" >> $GITHUB_OUTPUT
          # -----------------------------------------------------------

  update-configs:
    name: Update Values YAML with SHA Tags for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment
    runs-on: ubuntu-latest
    needs: [set-deployment-environment, build-and-push]
    if: always() # Keep this as 'always()' for now for continued debugging.

    permissions:
      contents: write

    steps:
      - name: Checkout VA-Cube-Configs repository
        uses: actions/checkout@v4
        with:
          repository: icipe-official/VA-Cube-Configs
          ssh-key: ${{ secrets.VA_CUBE_CONFIG_SSH_KEY }} # Switch to deploy keys
          path: VA-Cube-Configs # Checkout into this subdirectory
          fetch-depth: 0

      - name: Set up YQ (YAML processor)
        run: |
          sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/local/bin/yq && sudo chmod +x /usr/local/bin/yq

      - name: Determine helm values file path and SHA prefix
        id: helm-path
        run: |
          if [ "${{ needs.set-deployment-environment.outputs.deployment_environment }}" = "production" ]; then
            echo "HELM_VALUES_PATH=app-prod/helm-values.yaml" >> $GITHUB_OUTPUT
            echo "SHA_PREFIX=production-" >> $GITHUB_OUTPUT
          elif [ "${{ needs.set-deployment-environment.outputs.deployment_environment }}" = "test" ]; then
            echo "HELM_VALUES_PATH=app/helm-values.yaml" >> $GITHUB_OUTPUT
            echo "SHA_PREFIX=test-" >> $GITHUB_OUTPUT
          else
            echo "HELM_VALUES_PATH=values.yaml" >> $GITHUB_OUTPUT
            echo "SHA_PREFIX=" >> $GITHUB_OUTPUT
          fi
          echo "GIT_BRANCH=main" >> $GITHUB_OUTPUT

      - name: Update values.yaml with new SHA Tags
        run: |
          set -euo pipefail
          updated_any=0 

          # Get the helm values file path and SHA prefix based on environment
          HELM_FILE="${{ steps.helm-path.outputs.HELM_VALUES_PATH }}"
          GIT_BRANCH="${{ steps.helm-path.outputs.GIT_BRANCH }}"
          SHA_PREFIX="${{ steps.helm-path.outputs.SHA_PREFIX }}"
          echo "Updating helm values file: $HELM_FILE"
          echo "Target branch: $GIT_BRANCH"
          echo "SHA prefix: $SHA_PREFIX"

          # --- Get the new output from build-and-push job ---
          BUILT_SERVICES_WITH_SHA="${{ needs.build-and-push.outputs.built_services_with_sha }}"
          echo "Services built and their SHAs received: ${BUILT_SERVICES_WITH_SHA}"

          # Exit gracefully if no services were built/pushed
          if [ -z "$BUILT_SERVICES_WITH_SHA" ]; then
            echo "No services reported as built in the previous job. No values.yaml updates will be performed."
            exit 0 # Exit with success
          fi

          # Loop through the 'service_name:sha' pairs and update only those tags
          IFS=',' read -ra BUILT_SERVICE_PAIRS <<< "$BUILT_SERVICES_WITH_SHA"

          for pair in "${BUILT_SERVICE_PAIRS[@]}"; do
            img_key=$(echo "$pair" | cut -d':' -f1) # Extract service name
            current_image_sha=$(echo "$pair" | cut -d':' -f2) # Extract SHA which already includes prefix

            if [[ "$img_key" == "docker-umami" ]]; then
              img_key="umami"
            fi

            yq_path=".images.${img_key}.tag" 
            # Reference the appropriate helm-values.yaml file
            EXISTING_TAG=$(yq e "${yq_path}" VA-Cube-Configs/$HELM_FILE || echo "NOT_FOUND")

            if [[ "$EXISTING_TAG" != "$current_image_sha" ]]; then
              echo "Updating ${yq_path} from '${EXISTING_TAG}' to '${current_image_sha}'"
              # Reference the appropriate helm-values.yaml file
              yq e "${yq_path} = \"${current_image_sha}\"" -i VA-Cube-Configs/$HELM_FILE
              updated_any=1
            else
              echo "${img_key} tag in $HELM_FILE is already up to date: ${current_image_sha}"
            fi
          done

          if [ "$updated_any" -eq 1 ]; then
            echo "Changes detected in $HELM_FILE. Committing and pushing."
            
            # Change directory to the checked-out repo before git commands
            cd VA-Cube-Configs 
            
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git add $HELM_FILE
            git commit -m "chore(deps): Update image tags to latest SHAs for ${{ needs.set-deployment-environment.outputs.deployment_environment }} deployment environment" || echo "No changes to commit"
            
            # Push using the SSH deploy key to the other repository
            git push git@github.com:/icipe-official/VA-Cube-Configs.git HEAD:$GIT_BRANCH
          else
            echo "No image tag updates required."
          fi