nxtgauge-ai-assistant/.forgejo/workflows/build.yaml

name: build-and-release

on:
  push:
    branches:
      - main
      - high-performance

concurrency:
  group: ai-assistant-build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: docker-ready
    env:
      DOCKER_HOST: tcp://127.0.0.1:2375
      DOCKER_BUILDKIT: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        run: |
          set -euo pipefail
          for attempt in $(seq 1 30); do
            if docker version >/dev/null 2>&1; then
              break
            fi
            sleep 2
          done
          docker version
          docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
          docker buildx inspect --bootstrap

      - name: Login to registry
        env:
          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          test -n "$REGISTRY_HOSTPORT"
          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin

      - name: Build and push image
        env:
          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          metadata_file="/tmp/ai-assistant-metadata.json"
          image_ref="$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:$SHA"

          docker buildx build --push \
            --metadata-file "$metadata_file" \
            -f Dockerfile \
            -t "$image_ref" \
            .

          digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
          test -n "$digest"
          printf '%s@%s\n' "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant" "$digest" > /tmp/ai-assistant-image-ref.txt

      - name: Prune old SHA tags
        if: success()
        continue-on-error: true
        env:
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          python3 .forgejo/scripts/registry_prune.py \
            --registry "$REGISTRY_HOST" \
            --repo "nxtgauge-ai-assistant" \
            --username "$REGISTRY_USERNAME" \
            --password "$REGISTRY_PASSWORD" \
            --keep 2

      - name: Update GitOps release
        env:
          GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
          GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
          GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
          # The gitops repo lives on Forgejo (ci.nxtgauge.com), not GitHub.
          # GITEOPS_REPO/GITEOPS_SSH_KEY were never configured as repo
          # secrets; use GITOPS_PAT instead, matching backend-rust.
          GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }

          GITEOPS_DIR=$(mktemp -d)
          git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" "$GITEOPS_DIR"
          cd "$GITEOPS_DIR"

          image_ref="$(cat /tmp/ai-assistant-image-ref.txt)"

          for attempt in 1 2 3 4 5; do
            git checkout "$GITOPS_BRANCH"
            ./scripts/set-app-release.sh ai-assistant "$image_ref"

            if git diff --quiet; then
              echo "GitOps repo already up to date."
              exit 0
            fi

            git config user.name "forgejo-actions[bot]"
            git config user.email "forgejo-actions@ci.nxtgauge.com"
            git add apps scripts/set-app-release.sh
            git commit -m "chore(gitops): deploy ai-assistant@${SHA}"

            if git push origin "HEAD:$GITOPS_BRANCH"; then
              exit 0
            fi

            echo "Push rejected (attempt $attempt), pulling latest and retrying..."
            git fetch origin "$GITOPS_BRANCH"
            git reset --hard "origin/$GITOPS_BRANCH"
          done

          echo "Failed to push GitOps update after retries" >&2
          exit 1