ci.yaml

name: Container Image CI

on:
  pull_request:
    branches:
      - main
    paths:
      - 'microservices-demo/src/**'

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # automatically provided by GitHub Actions
  ECR_REGISTRY_URI: ${{ vars.ECR_REGISTRY_URI }}
  AWS_REGION: ${{ vars.AWS_REGION }}

jobs:
  discover_services:
    name: Discover Changed Microservices
    uses: ./.github/workflows/reusable_discover-app-services-changes.yaml

  build_and_push:
    needs: discover_services
    if: ${{ needs.discover_services.outputs.services != '[]' }}

    runs-on: ubuntu-latest

    permissions:
      contents: write # for creating git tags
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      pull-requests: write # for PR comments
      id-token: write # for AWS OIDC (if used in future)

    strategy:
      matrix:
        service: ${{ fromJson(needs.discover_services.outputs.services) }}
      fail-fast: false

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Calculate version and tags
        id: version
        run: |
          SERVICE="${{ matrix.service }}"
          SHORT_SHA=$(git rev-parse --short=7 HEAD)

          # Find latest version tag for this service
          LATEST_TAG=$(git tag -l "${SERVICE}-*" | grep -E "${SERVICE}-[0-9]+\.[0-9]+\.[0-9]+" | sort -V | tail -n1)

          if [ -z "$LATEST_TAG" ]; then
            # No previous version, start with 1.0.0
            VERSION="1.0.0"
          else
            # Extract version and increment patch
            VERSION_NUMBER=${LATEST_TAG#${SERVICE}-}
            IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION_NUMBER"
            PATCH=$((PATCH + 1))
            VERSION="${MAJOR}.${MINOR}.${PATCH}"
          fi

          # Construct version-sha tag (immutable)
          VERSION_SHA="${VERSION}-${SHORT_SHA}"

          echo "service=${SERVICE}" >> "$GITHUB_OUTPUT"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
          echo "version_sha=${VERSION_SHA}" >> "$GITHUB_OUTPUT"

          echo "- Service: ${SERVICE}"
          echo "- Version: ${VERSION}"
          echo "- SHA: ${SHORT_SHA}"
          echo "- Immutable tag: ${VERSION_SHA}"

      - name: Create git tag (only on push to main)
        if: github.event_name == 'push'
        run: |
          SERVICE="${{ steps.version.outputs.service }}"
          VERSION="${{ steps.version.outputs.version }}"
          GIT_TAG="${SERVICE}-${VERSION}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Create annotated tag
          git tag -a "$GIT_TAG" -m "Release ${VERSION} for ${SERVICE}" \
            -m "Commit: ${{ github.sha }}" \
            -m "Triggered by: ${{ github.actor }}"

          git push origin "$GIT_TAG"

          echo "Created git tag: ${GIT_TAG}"

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Prepare image tags
        id: tags
        run: |
          SERVICE="${{ steps.version.outputs.service }}"
          VERSION="${{ steps.version.outputs.version }}"
          VERSION_SHA="${{ steps.version.outputs.version_sha }}"
          REGISTRY="${{ env.ECR_REGISTRY_URI }}"

          # Base tags (always created)
          TAGS="${REGISTRY}/${SERVICE}:${VERSION_SHA}"

          # Dev tags (for PR and main branch)
          TAGS="${TAGS},${REGISTRY}/${SERVICE}:dev-${VERSION}"
          TAGS="${TAGS},${REGISTRY}/${SERVICE}:dev"

          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"

          echo "- Image tags to be created:"
          echo "    ${TAGS}" | tr ',' '\n' | sed 's/^/  - /'

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push to ECR
        uses: docker/build-push-action@v6
        with:
          context: ./microservices-demo/src/${{ matrix.service }}
          file: ./microservices-demo/src/${{ matrix.service }}/Dockerfile
          platforms: linux/amd64
          push: true
          tags: ${{ steps.tags.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.title=${{ matrix.service }}
            org.opencontainers.image.version=${{ steps.version.outputs.version }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.created=${{ github.event.head_commit.timestamp }}

      - name: Build summary
        run: |
          echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Service:** ${{ matrix.service }}" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Immutable tag:** ${{ steps.version.outputs.version_sha }}" >> $GITHUB_STEP_SUMMARY
          echo "**Git SHA:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Image Tags Created" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.tags.outputs.tags }}" | tr ',' '\n' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

          if [ "${{ github.event_name }}" == "push" ]; then
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Auto-deployed to dev environment**" >> $GITHUB_STEP_SUMMARY
          else
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Available for testing (dev tags created)**" >> $GITHUB_STEP_SUMMARY
          fi