name: Build and Push Docker Images

on:
  push:
    branches: ["main"]
  workflow_dispatch:

env:
  DOCKERHUB_REPO: taylanbakircioglu/flowfish

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - service: backend
            dockerfile: backend/Dockerfile
          - service: frontend
            dockerfile: frontend/Dockerfile.production
          - service: api-gateway
            dockerfile: services/api-gateway/Dockerfile
          - service: ingestion-service
            dockerfile: services/ingestion-service/Dockerfile
          - service: cluster-manager
            dockerfile: services/cluster-manager/Dockerfile
          - service: timeseries-writer
            dockerfile: services/timeseries-writer/Dockerfile
          - service: timeseries-query
            dockerfile: services/timeseries-query/Dockerfile
          - service: graph-writer
            dockerfile: services/graph-writer/Dockerfile
          - service: graph-query
            dockerfile: services/graph-query/Dockerfile
          - service: analysis-orchestrator
            dockerfile: services/analysis-orchestrator/Dockerfile
          - service: l7-ingestion-service
            dockerfile: services/l7-ingestion-service/Dockerfile
          - service: flowfish-l7-collector
            dockerfile: services/flowfish-l7-collector/Dockerfile
          - service: change-worker
            dockerfile: backend/Dockerfile.worker

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Read version from version.json
        id: version
        run: echo "VERSION=$(jq -r .version version.json)" >> "$GITHUB_OUTPUT"

      - name: Login to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          # Retry to tolerate transient docker.io timeouts, e.g.
          # 'Get "https://registry-1.docker.io/v2/": context deadline exceeded'.
          # Credentials are written to ~/.docker/config.json, which buildx
          # (docker/build-push-action) reads for the push.
          for attempt in 1 2 3 4 5; do
            if echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin; then
              echo "Logged in to Docker Hub on attempt $attempt"
              exit 0
            fi
            echo "Docker Hub login attempt $attempt failed; retrying in 10s..."
            sleep 10
          done
          echo "::error::Docker Hub login failed after 5 attempts"
          exit 1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build & Push ${{ matrix.service }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./${{ matrix.dockerfile }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ${{ env.DOCKERHUB_REPO }}:${{ matrix.service }}-${{ steps.version.outputs.VERSION }}
            ${{ env.DOCKERHUB_REPO }}:${{ matrix.service }}-latest
          cache-from: type=gha,scope=${{ matrix.service }}
          cache-to: type=gha,mode=max,scope=${{ matrix.service }}

  tag-release:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read version from version.json
        id: version
        run: echo "VERSION=$(jq -r .version version.json)" >> "$GITHUB_OUTPUT"

      - name: Create and push git tag (idempotent)
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          TAG="v${VERSION}"
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "Tag ${TAG} already exists on origin; nothing to do."
          else
            git config user.name "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git tag -a "${TAG}" -m "Release ${TAG}"
            git push origin "${TAG}"
            echo "Created and pushed tag ${TAG}"
          fi