tabatago/.github/workflows/admin-web-docker.yml

name: Admin Web Docker

on:
  push:
    branches: [main]
  pull_request:
    paths:
      - 'admin-web/**'
      - '.github/workflows/admin-web-docker.yml'
  workflow_dispatch:

concurrency:
  group: admin-web-docker-${{ github.ref }}
  cancel-in-progress: false

env:
  NODE_VERSION: "22"

jobs:
  build-validation:
    name: Docker Build Validation
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Install Docker CLI
        run: apt-get update -qq && apt-get install -y -qq docker.io

      - name: Build admin-web image (no push)
        env:
          NEXT_PUBLIC_SUPABASE_URL: ${{ vars.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ vars.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
        run: |
          set -e
          docker build \
            --file admin-web/Dockerfile \
            --build-arg "NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}" \
            --build-arg "NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}" \
            --tag "tabatago-admin-web:pr-validation" \
            admin-web

  semantic-release:
    name: Semantic Release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: |
      github.event_name != 'pull_request' &&
      (
        github.event_name == 'workflow_dispatch' ||
        (
          !contains(github.event.head_commit.message, '[skip ci]') &&
          !contains(github.event.head_commit.message, '[ci skip]')
        )
      )
    outputs:
      released: ${{ steps.release.outputs.released }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install release tooling
        run: npm ci

      - name: Record version before release
        id: before
        run: echo "version=$(node -p "require('./version.json').version")" >> "$GITHUB_OUTPUT"

      - name: Run semantic-release
        env:
          GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
          GITEA_URL: https://gitea.1000co.fr
        run: npx semantic-release

      - name: Check if released
        id: release
        run: |
          VERSION="$(node -p "require('./version.json').version")"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          if [ "${{ steps.before.outputs.version }}" != "$VERSION" ]; then
            echo "released=true" >> "$GITHUB_OUTPUT"
          else
            echo "released=false" >> "$GITHUB_OUTPUT"
          fi

  build-and-push:
    name: Build & Push Docker Image
    needs: semantic-release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: |
      github.event_name == 'workflow_dispatch' ||
      (
        !contains(github.event.head_commit.message, '[skip ci]') &&
        !contains(github.event.head_commit.message, '[ci skip]') &&
        needs.semantic-release.outputs.released == 'true'
      )
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Install Docker CLI
        run: apt-get update -qq && apt-get install -y -qq docker.io

      - name: Login to Gitea registry
        # Secret referenced via env (never inline in the run command) so it
        # cannot leak into logs. It is then piped to --password-stdin.
        env:
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
          DOCKER_USER: ${{ secrets.DOCKER_LOGIN }}
        run: echo "$DOCKER_PASSWORD" | docker login gitea.1000co.fr -u "$DOCKER_USER" --password-stdin

      - name: Build and push admin-web image
        env:
          VERSION: ${{ needs.semantic-release.outputs.version }}
          NEXT_PUBLIC_SUPABASE_URL: ${{ vars.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ vars.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
        run: |
          set -e
          if [ -z "${VERSION}" ]; then
            echo "::error::VERSION is empty — semantic-release produced no version."
            exit 1
          fi
          docker build \
            --file admin-web/Dockerfile \
            --build-arg "NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}" \
            --build-arg "NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}" \
            --tag "gitea.1000co.fr/millianlmx/admin-web:${VERSION}" \
            --tag "gitea.1000co.fr/millianlmx/admin-web:latest" \
            admin-web
          docker push "gitea.1000co.fr/millianlmx/admin-web:${VERSION}"
          docker push "gitea.1000co.fr/millianlmx/admin-web:latest"