name: Frontend image

# Runs when frontend/ or the build workflow changes. Use "Manual image publish" to force a build.
# Pull requests into develop only run the checks; the image build waits for the merge, which publishes :dev for
# testers, and the develop -> main pull request builds it again before a release.
on:
  push:
    branches: [main, develop]
    paths:
      - "frontend/**"
      - ".github/workflows/frontend-image.yml"
      - ".github/workflows/build-image.yml"
  pull_request:
    branches: [main, develop]
    paths:
      - "frontend/**"
      - ".github/workflows/frontend-image.yml"
      - ".github/workflows/build-image.yml"

concurrency:
  group: frontend-image-${{ github.ref }}
  # A newer push replaces an older run, but never one on main: cut off mid-release, a version could be tagged
  # without its GitHub release. Runs on main queue instead; the newest builds everything merged so far.
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  # Typecheck, lint, tests and a production build, natively. The image build skips the Dockerfile's test
  # stage, so this is the only place the frontend tests run.
  verify:
    # A main -> develop back-merge only brings release commits main already tested.
    if: github.head_ref != 'main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci --no-audit --no-fund
      - run: npm run verify

  # A merge into main may give the frontend a new version (release-project.yml); the image is built from it.
  release:
    needs: verify
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    uses: ./.github/workflows/release-project.yml
    with:
      project_dir: frontend
      title: Thingport frontend
    secrets: inherit

  build:
    needs: [verify, release]
    # Also when the release was skipped, as on pull requests; never after a failed one.
    if: >-
      ${{ !cancelled() && needs.verify.result == 'success' && needs.release.result != 'failure'
      && !(github.event_name == 'pull_request' && github.base_ref == 'develop') }}
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/build-image.yml
    with:
      ref: ${{ needs.release.outputs.ref }}
      version: ${{ needs.release.outputs.version }}
      project_dir: frontend
      image_name: ghcr.io/${{ github.repository_owner }}/thingport-frontend
      context: ./frontend
      dockerfile: frontend/Dockerfile
      cache_scope: frontend
      push: ${{ github.event_name != 'pull_request' }}
    secrets: inherit