ci.yml

name: CI

on:
  push:
    branches: ["main"]
  pull_request:
    types: [opened, reopened, synchronize, closed]
  release:
    types: [published]

permissions:
  contents: read
  packages: write

jobs:
  test-and-build:
    runs-on: ubuntu-latest
    env:
      GITOPS_REPO: ${{ vars.GITOPS_REPO }}
      APP_NAME: ${{ vars.APP_NAME }}
      IMAGE_TAG: ${{ github.sha }}
      VALUES_ENV: ${{ github.event_name == 'release' && 'prod' || 'test' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve image tag for release
        if: github.event_name == 'release'
        run: |
          echo "IMAGE_TAG=$(git rev-parse HEAD)" >> "$GITHUB_ENV"

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: "npm"

      - name: Install deps
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Set up Docker Buildx
        if: github.event_name != 'release' && (github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.head.repo.fork == false))
        uses: docker/setup-buildx-action@v3

      - name: Set up QEMU
        if: github.event_name != 'release' && (github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.head.repo.fork == false))
        uses: docker/setup-qemu-action@v3

      - name: Log in to GHCR
        if: github.event_name != 'release' && (github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.head.repo.fork == false))
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        if: github.event_name != 'release' && (github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.head.repo.fork == false))
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: |
            ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}
          labels: |
            org.opencontainers.image.source=${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: Checkout GitOps repo
        if: github.event_name == 'push' || github.event_name == 'release' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false)
        uses: actions/checkout@v4
        with:
          repository: ${{ env.GITOPS_REPO }}
          token: ${{ secrets.GITOPS_TOKEN }}
          path: gitops

      - name: Update GitOps values
        if: github.event_name == 'push' || github.event_name == 'release'
        run: |
          VALUES_PATH="gitops/environments/${{ env.VALUES_ENV }}/values.yaml"
          mkdir -p "$(dirname "$VALUES_PATH")"
          if [ ! -f "$VALUES_PATH" ]; then
            printf '%s\n' \
              "image:" \
              "  repository: ghcr.io/${{ github.repository }}" \
              "  tag: ${{ env.IMAGE_TAG }}" \
              > "$VALUES_PATH"
          fi
          sed -i -E "s#^([[:space:]]*repository:).*#\\1 ghcr.io/${{ github.repository }}#" "$VALUES_PATH" || true
          sed -i -E "s#^([[:space:]]*tag:).*#\\1 ${{ env.IMAGE_TAG }}#" "$VALUES_PATH" || true
          git -C gitops status --short

      - name: Commit and push GitOps changes
        if: github.event_name == 'push' || github.event_name == 'release'
        run: |
          cd gitops
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add "environments/${{ env.VALUES_ENV }}/values.yaml"
          if git diff --cached --quiet; then
            echo "No GitOps changes to commit."
            exit 0
          fi
          git commit -m "chore: update ${APP_NAME} image tag to ${{ env.IMAGE_TAG }}"
          git push

      - name: Update GitOps PR values
        if: github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.fork == false
        run: |
          PR_NAMESPACE="pr-${{ github.event.pull_request.number }}"
          PR_RESOURCE_NAME="${APP_NAME}-${PR_NAMESPACE}"
          VALUES_PATH="gitops/environments/dev/${PR_NAMESPACE}/values.yaml"
          mkdir -p "$(dirname "$VALUES_PATH")"
          if [ ! -f "$VALUES_PATH" ]; then
            printf '%s\n' \
              "namespace: ${PR_NAMESPACE}" \
              "deploymentName: ${PR_RESOURCE_NAME}" \
              "serviceName: ${PR_RESOURCE_NAME}" \
              "image:" \
              "  repository: ghcr.io/${{ github.repository }}" \
              "  tag: ${{ env.IMAGE_TAG }}" \
              > "$VALUES_PATH"
          fi
          sed -i -E "s#^([[:space:]]*namespace:).*#\\1 ${PR_NAMESPACE}#" "$VALUES_PATH" || true
          sed -i -E "s#^([[:space:]]*deploymentName:).*#\\1 ${PR_RESOURCE_NAME}#" "$VALUES_PATH" || true
          sed -i -E "s#^([[:space:]]*serviceName:).*#\\1 ${PR_RESOURCE_NAME}#" "$VALUES_PATH" || true
          grep -qE '^[[:space:]]*deploymentName:' "$VALUES_PATH" || echo "deploymentName: ${PR_RESOURCE_NAME}" >> "$VALUES_PATH"
          grep -qE '^[[:space:]]*serviceName:' "$VALUES_PATH" || echo "serviceName: ${PR_RESOURCE_NAME}" >> "$VALUES_PATH"
          sed -i -E "s#^([[:space:]]*repository:).*#\\1 ghcr.io/${{ github.repository }}#" "$VALUES_PATH" || true
          sed -i -E "s#^([[:space:]]*tag:).*#\\1 ${{ env.IMAGE_TAG }}#" "$VALUES_PATH" || true
          git -C gitops status --short

      - name: Commit and push GitOps PR values
        if: github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.fork == false
        run: |
          cd gitops
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add "environments/dev/pr-${{ github.event.pull_request.number }}/values.yaml"
          if git diff --cached --quiet; then
            echo "No PR values changes to commit."
            exit 0
          fi
          git commit -m "chore: update ${APP_NAME} PR-${{ github.event.pull_request.number }} values"
          git push

      - name: Delete GitOps PR environment
        if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.fork == false
        run: |
          PR_DIR="gitops/environments/dev/pr-${{ github.event.pull_request.number }}"
          if [ -d "$PR_DIR" ]; then
            rm -rf "$PR_DIR"
          fi
          git -C gitops status --short

      - name: Commit and push GitOps PR cleanup
        if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.fork == false
        run: |
          cd gitops
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A "environments/dev/pr-${{ github.event.pull_request.number }}"
          if git diff --cached --quiet; then
            echo "No PR environment changes to commit."
            exit 0
          fi
          git commit -m "chore: remove ${APP_NAME} PR-${{ github.event.pull_request.number }} environment"
          git push

  helm-publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check chart changes
        id: chart_changes
        run: |
          if git diff --name-only HEAD~1 | grep -q "^chart/"; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup Helm
        if: steps.chart_changes.outputs.changed == 'true'
        uses: azure/setup-helm@v4

      - name: Log in to GHCR for Helm
        if: steps.chart_changes.outputs.changed == 'true'
        run: |
          helm registry login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}

      - name: Package and push Helm chart
        if: steps.chart_changes.outputs.changed == 'true'
        run: |
          helm package chart --destination .
          CHART_TGZ="$(ls -1 *.tgz | head -1)"
          helm push "$CHART_TGZ" oci://ghcr.io/${{ github.repository }}