docker-publish.yml

name: Docker Build and Push

on:
  push:
    branches: [ main, 'feature/*' ]
  pull_request:
    branches: [ main ]

jobs:
  build-and-push:
    name: Build and Push to Docker Hub
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Login to Docker Hub
      # Secrets are NOT available on pull_request events — skip login on PRs
      if: github.event_name == 'push'
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_TOKEN }}

    - name: Build and push Docker image (push event)
      # On push: build + push to Docker Hub with clean, valid tags
      if: github.event_name == 'push'
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: |
          udaycodespace/credify:latest
          udaycodespace/credify:v2
          udaycodespace/credify:sha-${{ github.sha }}
        cache-from: type=registry,ref=udaycodespace/credify:buildcache
        cache-to: type=registry,ref=udaycodespace/credify:buildcache,mode=max

    - name: Build only (pull_request validation — no push)
      # On PR: just validate the image builds cleanly — no login, no push
      if: github.event_name == 'pull_request'
      uses: docker/build-push-action@v5
      with:
        context: .
        push: false
        tags: credify:pr-validate

    - name: Image digest
      run: echo "✅ Docker build step completed."