name: Backend image

# Runs when backend/ or the build workflow changes. Use "Manual image publish" to force a build.
# Pull requests into develop only run the checks; the image build (~6 min, arm64 under QEMU) waits for the
# merge, which publishes :dev for testers, and the develop -> main pull request builds it again before a release.
on:
  push:
    branches: [main, develop]
    paths:
      - "backend/**"
      - ".github/workflows/backend-image.yml"
      - ".github/workflows/build-image.yml"
  pull_request:
    branches: [main, develop]
    paths:
      - "backend/**"
      - ".github/workflows/backend-image.yml"
      - ".github/workflows/build-image.yml"

concurrency:
  group: backend-image-${{ github.ref }}
  # A newer push replaces an older run, but never one on main: cut off mid-release, a version could be tagged
  # without its GitHub release. Runs on main queue instead; the newest builds everything merged so far.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  # The full backend suite against real Postgres, including end-to-end provider imports. The image
  # is only built and published if this passes.
  test:
    # A main -> develop back-merge only brings release commits main already tested.
    if: github.head_ref != 'main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    services:
      postgres:
        image: postgres:16-alpine # same as docker-compose.yml
        env:
          POSTGRES_USER: thingport
          POSTGRES_PASSWORD: thingport
          POSTGRES_DB: thingport_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U thingport -d thingport_test"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      DATABASE_URL: postgresql://thingport:thingport@localhost:5432/thingport_test?schema=public
      FILE_STORAGE: /tmp/thingport-storage
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: backend/package-lock.json
      - run: npm ci --no-audit --no-fund
      - run: npx prisma generate
      - run: npm run lint
      # tsc: the typecheck the image build would otherwise be the only one to run.
      - run: npm run build
      - run: npx prisma migrate deploy
      - run: npm test

  # A merge into main may give the backend a new version (release-project.yml); the image is built from it.
  release:
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    uses: ./.github/workflows/release-project.yml
    with:
      project_dir: backend
      title: Thingport backend
    secrets: inherit

  build:
    needs: [test, release]
    # Also when the release was skipped, as on pull requests; never after a failed one.
    if: >-
      ${{ !cancelled() && needs.test.result == 'success' && needs.release.result != 'failure'
      && !(github.event_name == 'pull_request' && github.base_ref == 'develop') }}
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/build-image.yml
    with:
      ref: ${{ needs.release.outputs.ref }}
      version: ${{ needs.release.outputs.version }}
      project_dir: backend
      image_name: ghcr.io/${{ github.repository_owner }}/thingport-backend
      context: ./backend
      dockerfile: backend/Dockerfile
      cache_scope: backend
      push: ${{ github.event_name != 'pull_request' }}
    secrets: inherit