cd.yml

name: CD - Container Publish

on:
  push:
    branches: [master, main]
    tags:
      - 'v*.*.*'

env:
  BACKEND_IMAGE: jobhunter-backend
  FRONTEND_IMAGE: jobhunter-frontend
  GHCR_NAMESPACE: jasontm17

permissions:
  contents: read
  packages: write

jobs:
  docker-hub-check:
    name: Check Docker Hub credentials
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' ||
       startsWith(github.ref, 'refs/tags/v'))
    outputs:
      should_publish: ${{ steps.gate.outputs.should_publish }}
      reason: ${{ steps.gate.outputs.reason }}
    steps:
      - name: Evaluate Docker Hub secrets
        id: gate
        env:
          DH_USER: ${{ secrets.DOCKERHUB_USERNAME }}
          DH_PASS: ${{ secrets.DOCKERHUB_PASSWORD }}
        run: |
          if [ -z "$DH_USER" ] || [ -z "$DH_PASS" ]; then
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
            echo "reason=missing Docker Hub credentials" >> "$GITHUB_OUTPUT"
            echo "::notice title=Docker Hub publish skipped::Add DOCKERHUB_USERNAME and DOCKERHUB_PASSWORD in repository Actions secrets to enable image publishing."
            exit 0
          fi

          missing_scope=false
          for image in "$BACKEND_IMAGE" "$FRONTEND_IMAGE"; do
            scope="repository:${DH_USER}/${image}:pull,push"
            status="$(curl --silent --show-error --output /tmp/dockerhub-token.json --write-out "%{http_code}" \
              --user "${DH_USER}:${DH_PASS}" \
              "https://auth.docker.io/token?service=registry.docker.io&scope=${scope}" || true)"
            if [ "$status" != "200" ]; then
              missing_scope=true
              echo "::warning title=Docker Hub publish skipped::Credentials are present but do not have pull,push scope for ${DH_USER}/${image}. Create a Docker Hub access token with Read & Write permission."
            fi
          done

          if [ "$missing_scope" = "true" ]; then
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
            echo "reason=credentials missing Docker Hub pull,push scope" >> "$GITHUB_OUTPUT"
          else
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
            echo "reason=credentials valid for Docker Hub pull,push" >> "$GITHUB_OUTPUT"
          fi

  publish-docker-hub:
    name: Publish to Docker Hub
    runs-on: ubuntu-latest
    needs: docker-hub-check
    if: >-
      needs.docker-hub-check.outputs.should_publish == 'true' &&
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' ||
       startsWith(github.ref, 'refs/tags/v'))

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Docker metadata (backend)
        id: meta-backend
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.BACKEND_IMAGE }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=
          flavor: |
            latest=true
          labels: |
            org.opencontainers.image.title=Jobhunter Backend API
            org.opencontainers.image.description=Jobhunter REST API backend - Spring Boot, JWT authentication, RBAC, Flyway, MySQL, and production MVP workflows.
            org.opencontainers.image.source=https://github.com/JasonTM17/JobHunter_SpringBoot_RestfulAPI_React
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.vendor=Jobhunter

      - name: Docker metadata (frontend)
        id: meta-frontend
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.FRONTEND_IMAGE }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=
          flavor: |
            latest=true
          labels: |
            org.opencontainers.image.title=Jobhunter Frontend Web
            org.opencontainers.image.description=Jobhunter frontend - Next.js 16, TypeScript, responsive IT recruitment UI, E2E coverage, and visual regression.
            org.opencontainers.image.source=https://github.com/JasonTM17/JobHunter_SpringBoot_RestfulAPI_React
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.vendor=Jobhunter

      - name: Build and push backend
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          tags: ${{ steps.meta-backend.outputs.tags }}
          labels: ${{ steps.meta-backend.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: Build and push frontend
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          tags: ${{ steps.meta-frontend.outputs.tags }}
          labels: ${{ steps.meta-frontend.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: Image digest (backend)
        run: |
          echo "Backend image: ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.BACKEND_IMAGE }}"
          echo "Tags: ${{ steps.meta-backend.outputs.tags }}"

      - name: Image digest (frontend)
        run: |
          echo "Frontend image: ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.FRONTEND_IMAGE }}"
          echo "Tags: ${{ steps.meta-frontend.outputs.tags }}"

  publish-ghcr:
    name: Publish to GitHub Packages
    runs-on: ubuntu-latest
    if: >-
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' ||
       startsWith(github.ref, 'refs/tags/v'))

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: GHCR metadata (backend)
        id: ghcr-meta-backend
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ env.GHCR_NAMESPACE }}/${{ env.BACKEND_IMAGE }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=
          flavor: |
            latest=true
          labels: |
            org.opencontainers.image.title=Jobhunter Backend API
            org.opencontainers.image.description=Spring Boot API for the Jobhunter IT recruitment platform with JWT auth, RBAC, Flyway migrations, MySQL, Actuator metrics, and local production observability.
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.vendor=Jobhunter

      - name: GHCR metadata (frontend)
        id: ghcr-meta-frontend
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ env.GHCR_NAMESPACE }}/${{ env.FRONTEND_IMAGE }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=sha,prefix=
          flavor: |
            latest=true
          labels: |
            org.opencontainers.image.title=Jobhunter Frontend Web
            org.opencontainers.image.description=Next.js frontend for the Jobhunter IT recruitment platform with responsive job search, candidate/recruiter/admin workspaces, E2E coverage, and visual regression.
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.licenses=MIT
            org.opencontainers.image.vendor=Jobhunter

      - name: Build and push backend to GHCR
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          tags: ${{ steps.ghcr-meta-backend.outputs.tags }}
          labels: ${{ steps.ghcr-meta-backend.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: Build and push frontend to GHCR
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          tags: ${{ steps.ghcr-meta-frontend.outputs.tags }}
          labels: ${{ steps.ghcr-meta-frontend.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: GHCR summary
        run: |
          echo "## GitHub Packages" >> "$GITHUB_STEP_SUMMARY"
          echo "Backend tags:" >> "$GITHUB_STEP_SUMMARY"
          echo '${{ steps.ghcr-meta-backend.outputs.tags }}' >> "$GITHUB_STEP_SUMMARY"
          echo "Frontend tags:" >> "$GITHUB_STEP_SUMMARY"
          echo '${{ steps.ghcr-meta-frontend.outputs.tags }}' >> "$GITHUB_STEP_SUMMARY"

  verify-tag-build:
    name: Verify tag Docker build
    runs-on: ubuntu-latest
    needs: docker-hub-check
    if: >-
      github.event_name == 'push' &&
      startsWith(github.ref, 'refs/tags/v') &&
      needs.docker-hub-check.outputs.should_publish != 'true'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Verify backend build
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: false
          load: true
          tags: jobhunter-backend:verify
          cache-from: type=gha

      - name: Verify frontend build
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: false
          load: true
          tags: jobhunter-frontend:verify
          cache-from: type=gha

      - name: Docker images
        run: docker images | grep jobhunter

      - name: Summary
        env:
          PUBLISH_REASON: ${{ needs.docker-hub-check.outputs.reason }}
        run: |
          echo "## Release Docker verification" >> "$GITHUB_STEP_SUMMARY"
          echo "Tag: ${{ github.ref_name }}" >> "$GITHUB_STEP_SUMMARY"
          echo "Docker Hub publish: skipped because ${PUBLISH_REASON:-credentials are not configured}" >> "$GITHUB_STEP_SUMMARY"
          echo "Backend image: jobhunter-backend:verify" >> "$GITHUB_STEP_SUMMARY"
          echo "Frontend image: jobhunter-frontend:verify" >> "$GITHUB_STEP_SUMMARY"