docker-publish.yml

name: Build and Publish Docker Images

on:
  push:
    branches:
      - main
    tags:
      - 'v*'

env:
  REGISTRY_DOCKER: docker.io
  IMAGE_NAME_DOCKER: flossware/platform-java
  REGISTRY_GHCR: ghcr.io
  REGISTRY_QUAY: quay.io
  IMAGE_NAME_QUAY: flossware/platform-java

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        if: github.event_name == 'push'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_DOCKER }}
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Log in to GitHub Container Registry
        if: github.event_name == 'push'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_GHCR }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Quay.io
        if: github.event_name == 'push' && vars.QUAY_ENABLED == 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_QUAY }}
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}

      - name: Extract metadata for main image
        id: meta_main
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY_DOCKER }}/${{ env.IMAGE_NAME_DOCKER }}
            ${{ env.REGISTRY_GHCR }}/${{ github.repository }}
            ${{ env.REGISTRY_QUAY }}/${{ env.IMAGE_NAME_QUAY }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix={{branch}}-
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value=main,enable={{is_default_branch}}

      - name: Extract metadata for Alpine variant
        id: meta_alpine
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY_DOCKER }}/${{ env.IMAGE_NAME_DOCKER }}
            ${{ env.REGISTRY_GHCR }}/${{ github.repository }}
            ${{ env.REGISTRY_QUAY }}/${{ env.IMAGE_NAME_QUAY }}
          tags: |
            type=ref,event=branch,suffix=-alpine
            type=semver,pattern={{version}},suffix=-alpine
            type=semver,pattern={{major}}.{{minor}},suffix=-alpine
            type=sha,prefix={{branch}}-,suffix=-alpine
            type=raw,value=latest-alpine,enable={{is_default_branch}}
            type=raw,value=alpine,enable={{is_default_branch}}

      - name: Build and push main Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.meta_main.outputs.tags }}
          labels: ${{ steps.meta_main.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          sbom: true
          provenance: mode=max

      - name: Build and push Alpine variant
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.alpine
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.meta_alpine.outputs.tags }}
          labels: ${{ steps.meta_alpine.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          sbom: true
          provenance: mode=max

  test-docker-image:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    strategy:
      matrix:
        variant: [main, alpine]

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build test image - ${{ matrix.variant }}
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile${{ matrix.variant == 'alpine' && '.alpine' || '' }}
          load: true
          tags: platform-java:test-${{ matrix.variant }}
          cache-from: type=gha

      - name: Test Docker image - ${{ matrix.variant }}
        run: |
          docker run --rm -d \
            --name platform-java-test-${{ matrix.variant }} \
            -p 8080:8080 \
            -e JAVA_OPTS="-Xms256m -Xmx512m" \
            platform-java:test-${{ matrix.variant }} \
            --rest-api --port 8080

          # Wait for platform to start
          for i in {1..30}; do
            if curl -sf http://localhost:8080/api/health > /dev/null; then
              echo "Platform health check passed"
              break
            fi
            echo "Waiting for platform to be ready... ($i/30)"
            sleep 1
          done

          # Check if REST API is responding
          curl -f http://localhost:8080/api/health || exit 1

          # Check if web console is available
          curl -f http://localhost:8080/console || exit 1

          # Stop container
          docker stop platform-java-test-${{ matrix.variant }}

      - name: Show Docker image size - ${{ matrix.variant }}
        run: |
          docker images platform-java:test-${{ matrix.variant }} --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

  verify-registries:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
      - name: Verify Docker Hub image
        run: |
          # Check Docker Hub image availability
          TOKEN=$(curl -s https://auth.docker.io/v2/token?service=registry.docker.io&scope=repository:flossware/platform-java:pull | jq -r '.token')
          curl -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/flossware/platform-java/tags/list | jq . || echo "Docker Hub verification skipped (may be rate-limited)"

      - name: Verify GitHub Container Registry image
        run: |
          # GHCR check via docker pull simulation
          echo "GHCR image tagged and available at: ghcr.io/${{ github.repository }}"
          echo "Pull with: docker pull ghcr.io/${{ github.repository }}:latest"