name: Deploy

on:
    push:
        branches: ["main", "dev"]
    pull_request:
        branches: ["main", "dev"]

permissions:
    contents: read

jobs:
    build:
        name: Build
        runs-on: ubuntu-latest
        steps:
            - name: Checkout repository
              uses: actions/checkout@v4

            - name: Install pnpm
              uses: pnpm/action-setup@v6
              with:
                  version: 11.5.2

            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: "24"

            - name: Install dependencies
              run: |
                  cd Backend && pnpm install
                  cd ../UI && pnpm install

            - name: Generate Prisma client
              run: cd Backend && pnpm generate
              env:
                  DATABASE_URL: postgresql://x:x@localhost/x

            - name: Build backend
              run: cd Backend && pnpm run build

            - name: Build UI
              run: cd UI && pnpm run build

    test-and-lint:
        name: Test & Lint
        needs: build
        runs-on: ubuntu-latest
        services:
            postgres:
                image: postgres:16-alpine
                env:
                    POSTGRES_USER: patchpass
                    POSTGRES_PASSWORD: patchpass
                    POSTGRES_DB: patchpass
                ports:
                    - 5432:5432
                options: >-
                    --health-cmd "pg_isready -U patchpass"
                    --health-interval 10s
                    --health-timeout 5s
                    --health-retries 5
        env:
            TEST_DATABASE_URL: postgresql://patchpass:patchpass@localhost:5432/patchpass
        steps:
            - name: Checkout repository
              uses: actions/checkout@v4

            - name: Install pnpm
              uses: pnpm/action-setup@v6
              with:
                  version: 11.5.2

            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: "24"

            - name: Install dependencies
              run: |
                  cd Backend && pnpm install
                  cd ../UI && pnpm install

            - name: Generate Prisma client
              run: cd Backend && pnpm generate
              env:
                  DATABASE_URL: ${{ env.TEST_DATABASE_URL }}

            - name: Backend lint
              run: cd Backend && pnpm lint

            - name: UI lint
              run: cd UI && pnpm lint

            - name: Backend tests
              run: cd Backend && pnpm test

    push-image:
        name: Build and Push Docker Image
        needs: [build, test-and-lint]
        runs-on: ubuntu-latest
        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
        steps:
            - name: Checkout
              uses: actions/checkout@v4

            - name: Setup Buildx
              uses: docker/setup-buildx-action@v3

            - name: Generate image metadata
              id: meta
              uses: docker/metadata-action@v5
              with:
                  images: registry.reversed.dev/patchpass/core
                  tags: |
                      type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
                      type=raw,value=prod,enable=${{ github.ref == 'refs/heads/main' }}
                      type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
                      type=sha,format=long
                  labels: |
                      org.opencontainers.image.title=PatchPass
                      org.opencontainers.image.description=A human approval layer for AI agents
                      org.opencontainers.image.vendor=space

            - name: Log in to Harbor
              uses: docker/login-action@v3
              with:
                  registry: registry.reversed.dev
                  username: ${{ secrets.HARBOR_USERNAME }}
                  password: ${{ secrets.HARBOR_PASSWORD }}

            - name: Build and push image
              uses: docker/build-push-action@v6
              with:
                  context: .
                  push: true
                  provenance: false
                  sbom: false
                  tags: ${{ steps.meta.outputs.tags }}
                  labels: ${{ steps.meta.outputs.labels }}