name: build-and-push

on:
  push:
    branches:
      - main
      - high-performance

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      services_csv: ${{ steps.detect.outputs.services_csv }}
      has_changes: ${{ steps.detect.outputs.has_changes }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect changed services
        id: detect
        run: |
          set -euo pipefail

          set_output() {
            local key="$1"
            local value="$2"
            if [ -n "${GITHUB_OUTPUT:-}" ]; then
              echo "$key=$value" >> "$GITHUB_OUTPUT"
            fi
            echo "::set-output name=$key::$value"
          }

          if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
            CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
          else
            CHANGED_FILES=$(git ls-files)
          fi

          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | tr '\n' ' ')

          echo "Changed files:"
          echo "$CHANGED_FILES"

          ALL_SERVICES='gateway,users,companies,jobs,leads,job-seekers,customers,payments,employees,photographers,makeup-artists,tutors,developers,video-editors,graphic-designers,social-media-managers,fitness-trainers,catering-services,ugc-content-creators,cron'

          # Force full build for explicit trigger commits.
          if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger gitea pipeline|force build|rebuild all'; then
            set_output "services_csv" "$ALL_SERVICES"
            set_output "has_changes" "true"
            exit 0
          fi

          # Build everything for workflow/docker/shared backend changes.
          if echo "$CHANGED_FILES" | grep -Eq '^(\.gitea/workflows/|Dockerfile|Dockerfile\.|Cargo\.toml|Cargo\.lock|crates/|scripts/)'; then
            set_output "services_csv" "$ALL_SERVICES"
            set_output "has_changes" "true"
            exit 0
          fi

          SERVICES=''
          add_service() {
            local svc="$1"
            case ",${SERVICES}," in
              *",${svc},"*) ;;
              *)
                if [ -z "$SERVICES" ]; then
                  SERVICES="$svc"
                else
                  SERVICES="$SERVICES,$svc"
                fi
                ;;
            esac
          }

          while IFS= read -r f; do
            case "$f" in
              apps/gateway/*) add_service "gateway" ;;
              apps/users/*) add_service "users" ;;
              apps/companies/*) add_service "companies" ;;
              apps/jobs/*) add_service "jobs" ;;
              apps/leads/*) add_service "leads" ;;
              apps/job_seekers/*) add_service "job-seekers" ;;
              apps/customers/*) add_service "customers" ;;
              apps/payments/*) add_service "payments" ;;
              apps/employees/*) add_service "employees" ;;
              apps/photographers/*) add_service "photographers" ;;
              apps/makeup_artists/*) add_service "makeup-artists" ;;
              apps/tutors/*) add_service "tutors" ;;
              apps/developers/*) add_service "developers" ;;
              apps/video_editors/*) add_service "video-editors" ;;
              apps/graphic_designers/*) add_service "graphic-designers" ;;
              apps/social_media_managers/*) add_service "social-media-managers" ;;
              apps/fitness_trainers/*) add_service "fitness-trainers" ;;
              apps/catering_services/*) add_service "catering-services" ;;
              apps/ugc_content_creators/*) add_service "ugc-content-creators" ;;
              apps/cron/*) add_service "cron" ;;
            esac
          done <<< "$CHANGED_FILES"

          if [ -z "$SERVICES" ]; then
            set_output "services_csv" ""
            set_output "has_changes" "false"
          else
            set_output "services_csv" "$SERVICES"
            set_output "has_changes" "true"
          fi

  build:
    needs: detect-changes
    if: needs.detect-changes.outputs.has_changes == 'true'
    runs-on: ubuntu-latest
    env:
      DOCKER_HOST: unix:///var/run/docker.sock
    strategy:
      fail-fast: false
      matrix:
        service:
          - gateway
          - users
          - companies
          - jobs
          - leads
          - job-seekers
          - customers
          - payments
          - employees
          - photographers
          - makeup-artists
          - tutors
          - developers
          - video-editors
          - graphic-designers
          - social-media-managers
          - fitness-trainers
          - catering-services
          - ugc-content-creators
          - cron
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        run: |
          export DOCKER_HOST=unix:///var/run/docker.sock
          docker version
          docker buildx create --use || true
          docker buildx inspect --bootstrap

      - name: Login to Registry
        env:
          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          export DOCKER_HOST=unix:///var/run/docker.sock
          test -n "$REGISTRY_HOSTPORT"
          for attempt in 1 2 3 4 5; do
            echo "Registry login attempt $attempt to $REGISTRY_HOSTPORT"
            if echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin; then
              exit 0
            fi
            echo "Registry login failed (attempt $attempt); retrying..."
            sleep $((attempt * 8))
          done

          echo "Registry login failed after retries"
          exit 1

      - name: Build and push
        env:
          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
          SERVICES_CSV: ${{ needs.detect-changes.outputs.services_csv }}
        run: |
          set -euo pipefail
          export DOCKER_HOST=unix:///var/run/docker.sock
          if [ -n "$SERVICES_CSV" ] && ! echo ",$SERVICES_CSV," | grep -q ",${{ matrix.service }},"; then
            echo "Skipping unchanged service: ${{ matrix.service }}"
            exit 0
          fi

          build_with_cache() {
            docker buildx build --push \
              -f Dockerfile.simple \
              --build-arg SERVICE_NAME=${{ matrix.service }} \
              --cache-from type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache \
              --cache-to type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache,mode=max \
              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
              .
          }

          build_without_cache_export() {
            docker buildx build --push \
              -f Dockerfile.simple \
              --build-arg SERVICE_NAME=${{ matrix.service }} \
              --cache-from type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache \
              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
              .
          }

          for attempt in 1 2 3; do
            echo "Build attempt $attempt with cache export for ${{ matrix.service }}"
            if build_with_cache; then
              exit 0
            fi
            echo "Attempt $attempt failed; retrying after backoff"
            sleep $((attempt * 10))
          done

          echo "Falling back to build without cache export for ${{ matrix.service }}"
          if ! build_without_cache_export; then
            echo "Final fallback: push tags without cache"
            docker buildx build --push \
              -f Dockerfile.simple \
              --build-arg SERVICE_NAME=${{ matrix.service }} \
              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
              -t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
              .
          fi

      - name: Prune old image tags (keep latest 1 SHA)
        if: success()
        continue-on-error: true
        env:
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          python3 .gitea/scripts/registry_prune.py \
            --registry "$REGISTRY_HOST" \
            --repo "nxtgauge-rust-${{ matrix.service }}" \
            --username "$REGISTRY_USERNAME" \
            --password "$REGISTRY_PASSWORD" \
            --keep 1

      - name: Update GitOps and trigger deployment
        if: always()
        continue-on-error: true
        env:
          GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
          GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
        run: |
          set -euo pipefail

          if [ -z "$GITEOPS_REPO" ]; then
            echo "GITEOPS_REPO secret not set, skipping GitOps update"
            exit 0
          fi

          # Clone gitops repo
          GITEOPS_DIR=$(mktemp -d)
          git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
          cd "$GITEOPS_DIR"

          # Set up SSH key for push
          mkdir -p ~/.ssh
          echo "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null

          # Update gitops with new SHA
          python3 .gitea/scripts/update-gitops.py \
            --repo "$GITEOPS_DIR" \
            --service "${{ matrix.service }}" \
            --sha "${{ gitea.sha }}" \
            --message "chore: deploy ${{ matrix.service }}@${{ gitea.sha }}"

          rm -rf "$GITEOPS_DIR"