nxtgauge-backend-rust/.forgejo/workflows/build.yaml

name: build-and-release

on:
  push:
    branches:
      - main
      - high-performance

concurrency:
  group: backend-build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: docker-ready
    # Explicit container: (rather than relying only on the docker-ready
    # label mapping) so job-level container options are reliably honored.
    container:
      image: ci.nxtgauge.com/admin/forgejo-runner-job:bookworm
      options: --add-host=host.docker.internal:host-gateway
    env:
      # 127.0.0.1 doesn't work here: the job container is nested one level
      # inside the runner pod's dind sidecar, so its own loopback isn't the
      # sidecar's. host.docker.internal (mapped via --add-host above)
      # reaches back to the dind engine that actually spawned this container.
      DOCKER_HOST: tcp://host.docker.internal:2375
      DOCKER_BUILDKIT: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect changed services
        run: |
          set -euo pipefail
          ALL_SERVICES='gateway users companies jobs leads job-seekers customers payments employees photographers makeup-artists tutors developers video-editors graphic-designers social-media-managers fitness-trainers catering-services ugc-content-creators cron'

          if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
            CHANGED_FILES="$(git diff --name-only HEAD^ HEAD)"
          else
            CHANGED_FILES="$(git ls-files)"
          fi

          LAST_COMMIT_MSG="$(git log -1 --pretty=%B | tr '\n' ' ')"

          force_full_build=false
          if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger build|force build|rebuild all'; then
            force_full_build=true
          elif echo "$CHANGED_FILES" | grep -Eq '^(\.forgejo/workflows/|Dockerfile|Cargo\.toml|Cargo\.lock|crates/|scripts/)'; then
            force_full_build=true
          fi

          if [ "$force_full_build" = true ]; then
            printf '%s\n' $ALL_SERVICES > /tmp/changed-services.txt
            exit 0
          fi

          : > /tmp/changed-services.txt
          while IFS= read -r f; do
            case "$f" in
              apps/gateway/*) echo gateway >> /tmp/changed-services.txt ;;
              apps/users/*) echo users >> /tmp/changed-services.txt ;;
              apps/companies/*) echo companies >> /tmp/changed-services.txt ;;
              apps/jobs/*) echo jobs >> /tmp/changed-services.txt ;;
              apps/leads/*) echo leads >> /tmp/changed-services.txt ;;
              apps/job_seekers/*) echo job-seekers >> /tmp/changed-services.txt ;;
              apps/customers/*) echo customers >> /tmp/changed-services.txt ;;
              apps/payments/*) echo payments >> /tmp/changed-services.txt ;;
              apps/employees/*) echo employees >> /tmp/changed-services.txt ;;
              apps/photographers/*) echo photographers >> /tmp/changed-services.txt ;;
              apps/makeup_artists/*) echo makeup-artists >> /tmp/changed-services.txt ;;
              apps/tutors/*) echo tutors >> /tmp/changed-services.txt ;;
              apps/developers/*) echo developers >> /tmp/changed-services.txt ;;
              apps/video_editors/*) echo video-editors >> /tmp/changed-services.txt ;;
              apps/graphic_designers/*) echo graphic-designers >> /tmp/changed-services.txt ;;
              apps/social_media_managers/*) echo social-media-managers >> /tmp/changed-services.txt ;;
              apps/fitness_trainers/*) echo fitness-trainers >> /tmp/changed-services.txt ;;
              apps/catering_services/*) echo catering-services >> /tmp/changed-services.txt ;;
              apps/ugc_content_creators/*) echo ugc-content-creators >> /tmp/changed-services.txt ;;
              apps/cron/*) echo cron >> /tmp/changed-services.txt ;;
            esac
          done <<<"$CHANGED_FILES"

          sort -u /tmp/changed-services.txt -o /tmp/changed-services.txt

      - name: Stop if nothing changed
        run: |
          set -euo pipefail
          if [ ! -s /tmp/changed-services.txt ]; then
            echo "No backend service changes detected."
            exit 0
          fi

      - name: Set up Docker Buildx
        run: |
          set -euo pipefail
          [ -s /tmp/changed-services.txt ] || exit 0
          docker version
          docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
          docker buildx inspect --bootstrap

      - name: Login to registry
        env:
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOST || 'ci.nxtgauge.com' }}
          REGISTRY_NAMESPACE: ${{ secrets.REGISTRY_NAMESPACE || 'ashwin' }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          [ -s /tmp/changed-services.txt ] || exit 0
          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin

      - name: Build changed services
        env:
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOST || 'ci.nxtgauge.com' }}
          REGISTRY_NAMESPACE: ${{ secrets.REGISTRY_NAMESPACE || 'ashwin' }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          [ -s /tmp/changed-services.txt ] || exit 0
          : > /tmp/built-services.tsv
          while IFS= read -r service; do
            [ -n "$service" ] || continue
            metadata_file="/tmp/${service}-metadata.json"
            image_ref="$REGISTRY_HOST/$REGISTRY_NAMESPACE/nxtgauge-rust-${service}:${SHA}"

            docker buildx build --push \
              --metadata-file "$metadata_file" \
              -f Dockerfile.simple \
              --build-arg SERVICE_NAME="$service" \
              -t "$image_ref" \
              .

            digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
            if [ -z "$digest" ]; then
              echo "Failed to determine digest for $service" >&2
              exit 1
            fi

            printf '%s\t%s\n' "$service" "$digest" >> /tmp/built-services.tsv
          done < /tmp/changed-services.txt

      - name: Update GitOps release state
        env:
          GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
          GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
          GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
          GITOPS_PUSH_USERNAME: ${{ secrets.GITOPS_PUSH_USERNAME }}
          GITOPS_PUSH_TOKEN: ${{ secrets.GITOPS_PUSH_TOKEN }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          [ -s /tmp/built-services.tsv ] || exit 0
          test -n "${GITOPS_PUSH_TOKEN:-}" || { echo "GITOPS_PUSH_TOKEN is empty"; exit 1; }

          git clone "https://${GITOPS_PUSH_USERNAME}:${GITOPS_PUSH_TOKEN}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
          cd /tmp/nxtgauge-gitops
          git checkout "$GITOPS_BRANCH"

          while IFS=$'\t' read -r service digest; do
            [ -n "$service" ] || continue
            ./scripts/set-backend-rust-release.sh "$service" "$digest"
          done < /tmp/built-services.tsv

          if git diff --quiet; then
            echo "GitOps repo already up to date."
            exit 0
          fi

          git config user.name "forgejo-actions[bot]"
          git config user.email "forgejo-actions@ci.nxtgauge.com"
          git add \
            apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv \
            apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml \
            apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml
          git commit -m "chore(gitops): update backend rust images for ${SHA}"
          git push origin "HEAD:${GITOPS_BRANCH}"