ci.yml

name: CI/CD

on:
  push:
    branches: [main, develop]
    tags: ['v*.*.*']
    paths:
      - 'backend/**'
      - 'frontend/**'
      - 'services/auth-sidecar/**'
      - 'environments/**'
      - 'compose*.yml'
      - 'scripts/**'
      - 'infrastructure/**'
      - '.github/workflows/ci.yml'
      - 'VERSION'
  pull_request:
    branches: [main, develop]
    paths:
      - 'backend/**'
      - 'frontend/**'
      - 'services/auth-sidecar/**'
      - 'environments/**'
      - 'compose*.yml'
      - 'scripts/**'
      - 'infrastructure/**'
      - '.github/workflows/ci.yml'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write
  actions: read

jobs:
  changes:
    name: Detect changed paths
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      auth-sidecar: ${{ steps.filter.outputs.auth-sidecar }}
      environments: ${{ steps.filter.outputs.environments }}
      env-base: ${{ steps.filter.outputs.env-base }}
      env-conda-base: ${{ steps.filter.outputs.env-conda-base }}
      env-workspace: ${{ steps.filter.outputs.env-workspace }}
      env-dev: ${{ steps.filter.outputs.env-dev }}
      compose: ${{ steps.filter.outputs.compose }}
      any: ${{ steps.filter.outputs.any }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            backend:
              - 'backend/**'
            frontend:
              - 'frontend/**'
            auth-sidecar:
              - 'services/auth-sidecar/**'
            environments:
              - 'environments/**'
            env-base:
              - 'environments/base/**'
            env-conda-base:
              - 'environments/conda-base/**'
            env-workspace:
              - 'environments/workspace/**'
            env-dev:
              - 'environments/dev/**'
            compose:
              - 'compose*.yml'
              - 'scripts/**'
              - 'infrastructure/**'
            any:
              - 'backend/**'
              - 'frontend/**'
              - 'services/auth-sidecar/**'
              - 'environments/**'
              - 'compose*.yml'
              - 'scripts/**'
              - 'infrastructure/**'
              - '.github/workflows/ci.yml'
              - 'VERSION'

  lint-backend:
    name: Lint Backend
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.compose == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Lint backend
        run: |
          ./nukelabctl lint backend

  lint-frontend:
    name: Lint Frontend
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.compose == 'true' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: ./frontend/package-lock.json

      - name: Install dependencies
        working-directory: ./frontend
        run: npm ci

      - name: Lint
        working-directory: ./frontend
        run: npm run lint

      - name: Format check
        working-directory: ./frontend
        run: npm run format:check

      - name: Build
        working-directory: ./frontend
        run: npm run build

  test-backend:
    name: Test Backend
    runs-on: ubuntu-latest
    needs: changes
    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.compose == 'true' || github.event_name == 'workflow_dispatch'
    env:
      CONTAINER_ENGINE: docker
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Set up environment
        run: |
          cp .env.example .env.development
          mkdir -p /tmp/nukelab-volumes
          echo "VOLUME_STORAGE_PATH=/tmp/nukelab-volumes" >> .env.development

      - name: Run backend tests
        run: ./nukelabctl test backend --coverage --cov-report=xml

      - name: Coverage summary
        uses: irongut/CodeCoverageSummary@v1.3.0
        with:
          filename: backend/coverage.xml
          badge: true
          fail_below_min: false
          format: markdown
          hide_branch_rate: false
          hide_complexity: true
          indicators: true
          output: both
          thresholds: '60 80'

      - name: Stop backing services
        if: always()
        run: |
          ./nukelabctl stop dev || true

  build-images:
    name: Build & push images
    runs-on: ubuntu-latest
    needs: [changes, lint-backend, lint-frontend, test-backend]
    if: |
      !cancelled() &&
      !contains(needs.*.result, 'cancelled') &&
      (needs.changes.outputs.any == 'true' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) &&
      needs.lint-backend.result != 'failure' &&
      needs.lint-frontend.result != 'failure' &&
      needs.test-backend.result != 'failure'
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: backend
            context: ./backend
            dockerfile: ./backend/Dockerfile
            target: runtime
            image: ghcr.io/${{ github.repository_owner }}/nukelab-backend
          - name: frontend
            context: ./frontend
            dockerfile: ./frontend/Dockerfile
            image: ghcr.io/${{ github.repository_owner }}/nukelab-frontend
          - name: auth-sidecar
            context: ./services/auth-sidecar
            dockerfile: ./services/auth-sidecar/Dockerfile
            image: ghcr.io/${{ github.repository_owner }}/nukelab-auth-sidecar
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        if: github.event_name == 'push'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate image tags
        id: meta
        run: |
          ./scripts/ci-version.sh
        env:
          GITHUB_REF: ${{ github.ref }}
          GITHUB_SHA: ${{ github.sha }}
          IMAGE_NAME: ${{ matrix.image }}

      - name: Build and push
        if: |
          (matrix.name == 'backend' && needs.changes.outputs.backend == 'true') ||
          (matrix.name == 'frontend' && needs.changes.outputs.frontend == 'true') ||
          (matrix.name == 'auth-sidecar' && needs.changes.outputs.auth-sidecar == 'true') ||
          needs.changes.outputs.compose == 'true' ||
          github.event_name == 'workflow_dispatch' ||
          startsWith(github.ref, 'refs/tags/v')
        uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          target: ${{ matrix.target }}
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.meta.outputs.tags }}
          # Inject the resolved version into the backend image so the running
          # API reports the exact image tag (APP_VERSION env, see backend/Dockerfile).
          build-args: ${{ matrix.name == 'backend' && format('APP_VERSION={0}', steps.meta.outputs.version) || '' }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}

  build-environments:
    name: Build & push environment images
    runs-on: ubuntu-latest
    needs: [build-images, changes]
    if: |
      !cancelled() &&
      !contains(needs.*.result, 'cancelled') &&
      (needs.changes.outputs.environments == 'true' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) &&
      needs.build-images.result != 'failure'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        if: github.event_name == 'push'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate version
        id: meta
        run: |
          ./scripts/ci-version.sh
        env:
          GITHUB_REF: ${{ github.ref }}
          GITHUB_SHA: ${{ github.sha }}
          IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/nukelab-environment-base

      - name: Build and push base
        if: needs.changes.outputs.env-base == 'true' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
        uses: ./.github/actions/build-environment
        with:
          context: .
          dockerfile: ./environments/base/Dockerfile
          image: ghcr.io/${{ github.repository_owner }}/nukelab-environment-base
          version: ${{ steps.meta.outputs.version }}
          build-args: AUTH_SIDECAR_IMAGE=ghcr.io/${{ github.repository_owner }}/nukelab-auth-sidecar:${{ steps.meta.outputs.version }}
          cache-scope: base
          push: ${{ github.event_name == 'push' }}

      - name: Build and push conda-base
        if: needs.changes.outputs.env-conda-base == 'true' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
        uses: ./.github/actions/build-environment
        with:
          context: ./environments/conda-base
          dockerfile: ./environments/conda-base/Dockerfile
          image: ghcr.io/${{ github.repository_owner }}/nukelab-environment-conda-base
          version: ${{ steps.meta.outputs.version }}
          build-args: BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/nukelab-environment-base:${{ steps.meta.outputs.version }}
          cache-scope: conda-base
          push: ${{ github.event_name == 'push' }}

      - name: Build and push workspace
        if: needs.changes.outputs.env-workspace == 'true' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
        uses: ./.github/actions/build-environment
        with:
          context: ./environments/workspace
          dockerfile: ./environments/workspace/Dockerfile
          image: ghcr.io/${{ github.repository_owner }}/nukelab-environment-workspace
          version: ${{ steps.meta.outputs.version }}
          build-args: BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/nukelab-environment-conda-base:${{ steps.meta.outputs.version }}
          cache-scope: workspace
          push: ${{ github.event_name == 'push' }}

      - name: Build and push dev
        if: needs.changes.outputs.env-dev == 'true' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
        uses: ./.github/actions/build-environment
        with:
          context: ./environments/dev
          dockerfile: ./environments/dev/Dockerfile
          image: ghcr.io/${{ github.repository_owner }}/nukelab-environment-dev
          version: ${{ steps.meta.outputs.version }}
          build-args: BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/nukelab-environment-conda-base:${{ steps.meta.outputs.version }}
          cache-scope: dev
          push: ${{ github.event_name == 'push' }}