deploy-docker.yml

name: Deploy to Docker

on:
  workflow_dispatch:
    inputs:
      rc_tag:
        description: "RC tag name (e.g. 1.2.3-rc)"
        required: true
        type: string
  workflow_run:
    workflows: ["Create Release Tag"]
    types: [completed]
    branches: [main]

permissions:
  contents: read

concurrency:
  group: deploy-dev
  cancel-in-progress: true

env:
  REGISTRY: docker.io
  IMAGE_REPOSITORY: m8flow
  PROJECT: m8flow
  COMPONENTS: '["backend", "frontend", "keycloak", "connector-proxy"]'

jobs:
  prepare:
    name: Prepare (resolve ref & tag)
    if: |
      (vars.AUTO_BUILD == 'true' || github.event_name == 'workflow_dispatch') &&
      (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success')
    runs-on: ubuntu-latest
    outputs:
      ref: ${{ steps.meta.outputs.ref }}
      tag: ${{ steps.meta.outputs.tag }}
      components: ${{ env.COMPONENTS }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.rc_tag || github.event.workflow_run.head_sha || github.ref }}
          fetch-depth: 0 # Required to find tags at HEAD

      - name: Extract metadata
        id: meta
        run: |
          if [[ -n "${{ github.event.inputs.rc_tag }}" ]]; then
            TAG="${{ github.event.inputs.rc_tag }}"
          elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
            git fetch origin --tags
            TAG=$(git tag --points-at HEAD | sort -V | tail -1)
            [[ -z "$TAG" ]] && { echo "::error::No tag found at HEAD"; exit 1; }
          else
            TAG="${{ github.ref_name }}"
          fi
          echo "tag=${TAG}" >> $GITHUB_OUTPUT
          echo "ref=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

  backup-existing-tags:
    name: Backup Tags
    needs: prepare
    runs-on: ubuntu-latest
    strategy:
      matrix:
        component: ${{ fromJson(needs.prepare.outputs.components) }}
    steps:
      - name: Setup regctl
        uses: regclient/actions/regctl-installer@v0.1.0

      - name: Login to Docker Hub
        env:
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
        run: |
          echo "$DOCKERHUB_TOKEN" | regctl registry login ${{ env.REGISTRY }} -u "$DOCKERHUB_USERNAME" --pass-stdin

      - name: Manage Backup Tags
        env:
          FULL_REPO: "${{ env.REGISTRY }}/${{ env.IMAGE_REPOSITORY }}/${{ env.PROJECT }}-${{ matrix.component }}"
          TAG: "${{ needs.prepare.outputs.tag }}"
        run: |
          # 1. Check if the current tag exists.
          if ! regctl image inspect "${FULL_REPO}:${TAG}" > /dev/null 2>&1; then
            echo "Tag ${TAG} not found on remote. Nothing to backup."
            exit 0
          fi

          # 2. If a backup already exists, delete it so we can overwrite it.
          # Some registries don't allow overwriting a tag via 'copy' if it exists.
          if regctl image inspect "${FULL_REPO}:${TAG}-backup" > /dev/null 2>&1; then
            echo "Found existing backup. Deleting..."
            regctl tag rm "${FULL_REPO}:${TAG}-backup" || true
          fi

          # 3. Server-side retag (No layer download)
          echo "Backing up ${TAG} to ${TAG}-backup..."
          regctl image copy "${FULL_REPO}:${TAG}" "${FULL_REPO}:${TAG}-backup"

  build:
    name: Build & Push
    needs: [prepare, backup-existing-tags]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        component: ${{ fromJson(needs.prepare.outputs.components) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.ref }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build & Push
        id: build
        uses: docker/build-push-action@v5
        with:
          context: ${{ matrix.component == 'connector-proxy' && 'm8flow-connector-proxy' || '.' }}
          file: ${{ matrix.component == 'connector-proxy' && 'm8flow-connector-proxy/Dockerfile' || format('docker/m8flow.{0}.Dockerfile', matrix.component) }}
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_REPOSITORY }}/${{ env.PROJECT }}-${{ matrix.component }}:${{ needs.prepare.outputs.tag }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_REPOSITORY }}/${{ env.PROJECT }}-${{ matrix.component }}:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_REPOSITORY }}/${{ env.PROJECT }}-${{ matrix.component }}:buildcache,mode=max
          provenance: true
          sbom: true

      - name: Save Digest
        run: echo "${{ steps.build.outputs.digest }}" > digest.txt

      - name: Upload Digest Artifact
        uses: actions/upload-artifact@v4
        with:
          name: digest-${{ matrix.component }}
          path: digest.txt
          retention-days: 1

  combine:
    name: Finalize Artifacts
    needs: [prepare, build]
    runs-on: ubuntu-latest
    steps:
      - name: Download all digests
        uses: actions/download-artifact@v4
        with:
          path: digests
          pattern: digest-*
          merge-multiple: false

      - name: Create Summary
        run: |
          echo "### Deployment Summary - ${{ needs.prepare.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
          echo "| Component | Digest |" >> $GITHUB_STEP_SUMMARY
          echo "|-----------|--------|" >> $GITHUB_STEP_SUMMARY
          for f in digests/digest-*/digest.txt; do
            COMPONENT=$(basename $(dirname $f) | sed 's/digest-//')
            DIGEST=$(cat $f)
            echo "| $COMPONENT | \`$DIGEST\` |" >> $GITHUB_STEP_SUMMARY
          done