name: Build and Push Docker Images

on:
  push:
    branches: [ main, develop ]
    tags: [ 'v*.*.*' ]
  pull_request:
    branches: [ main ]
  release:
    types: [ published ]
  workflow_dispatch:
    inputs:
      push:
        description: 'Push images to registry'
        required: false
        default: 'false'
        type: choice
        options:
          - 'true'
          - 'false'

env:
  REGISTRY: ghcr.io
  BACKEND_IMAGE_NAME: ${{ github.repository }}/backend
  FRONTEND_IMAGE_NAME: ${{ github.repository }}/frontend

jobs:
  build-backend:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Determine build platforms
      id: platforms
      run: |
        # For PRs, build only amd64 to avoid QEMU emulation issues with Sharp
        # For main/develop/tags, build multi-arch
        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
        else
          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
        fi

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      with:
        platforms: ${{ steps.platforms.outputs.platforms }}

    - name: Log in to Container Registry
      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
      id: login-ghcr
      continue-on-error: true
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata for Backend
      id: meta-backend
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}
        labels: |
          org.opencontainers.image.title=PicPeak Backend
          org.opencontainers.image.description=PicPeak photo sharing platform backend service
          org.opencontainers.image.vendor=PicPeak
          maintainer=${{ github.repository_owner }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=sha,format=short
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push Backend Docker image
      uses: docker/build-push-action@v5
      with:
        context: ./backend
        file: ./backend/Dockerfile
        # Always build; only push when registry login succeeded
        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
        tags: ${{ steps.meta-backend.outputs.tags }}
        labels: ${{ steps.meta-backend.outputs.labels }}
        platforms: ${{ steps.platforms.outputs.platforms }}
        cache-from: type=gha,scope=backend
        cache-to: type=gha,mode=max,scope=backend
        build-args: |
          CACHEBUST=${{ github.run_number }}
          BUILD_DATE=${{ github.event.head_commit.timestamp }}
          VCS_REF=${{ github.sha }}
          VERSION=${{ steps.meta-backend.outputs.version }}

    - name: Run Trivy vulnerability scanner
      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:${{ steps.meta-backend.outputs.version }}
        format: 'sarif'
        output: 'trivy-backend.sarif'
        severity: 'CRITICAL,HIGH'
        timeout: '10m'

    - name: Upload Trivy scan results to GitHub Security tab
      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-backend.sarif'
        category: 'backend-vulnerabilities'

  build-frontend:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Determine build platforms
      id: platforms
      run: |
        # For PRs, build only amd64 to avoid QEMU emulation issues
        # For main/develop/tags, build multi-arch
        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
          echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
        else
          echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
        fi

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      with:
        platforms: ${{ steps.platforms.outputs.platforms }}

    - name: Log in to Container Registry
      if: github.event_name != 'pull_request' || github.event.inputs.push == 'true'
      id: login-ghcr
      continue-on-error: true
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata for Frontend
      id: meta-frontend
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}
        labels: |
          org.opencontainers.image.title=PicPeak Frontend
          org.opencontainers.image.description=PicPeak photo sharing platform frontend application
          org.opencontainers.image.vendor=PicPeak
          maintainer=${{ github.repository_owner }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=sha,format=short
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push Frontend Docker image
      uses: docker/build-push-action@v5
      with:
        context: ./frontend
        file: ./frontend/Dockerfile
        # Always build; only push when registry login succeeded
        push: ${{ (github.event_name != 'pull_request' || github.event.inputs.push == 'true') && steps.login-ghcr.outcome == 'success' }}
        tags: ${{ steps.meta-frontend.outputs.tags }}
        labels: ${{ steps.meta-frontend.outputs.labels }}
        platforms: ${{ steps.platforms.outputs.platforms }}
        cache-from: type=gha,scope=frontend
        cache-to: type=gha,mode=max,scope=frontend
        build-args: |
          CACHEBUST=${{ github.run_number }}
          BUILD_DATE=${{ github.event.head_commit.timestamp }}
          VCS_REF=${{ github.sha }}
          VERSION=${{ steps.meta-frontend.outputs.version }}

    - name: Run Trivy vulnerability scanner
      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ steps.meta-frontend.outputs.version }}
        format: 'sarif'
        output: 'trivy-frontend.sarif'
        severity: 'CRITICAL,HIGH'
        timeout: '10m'

    - name: Upload Trivy scan results to GitHub Security tab
      if: github.event_name != 'pull_request' && steps.login-ghcr.outcome == 'success'
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-frontend.sarif'
        category: 'frontend-vulnerabilities'

  # Note: The publish-manifest job is not needed since docker/build-push-action@v5
  # automatically creates multi-arch manifests when building for multiple platforms.
  # The images are already properly tagged and include all architectures.

  summary:
    needs: [build-backend, build-frontend]
    if: always()
    runs-on: ubuntu-latest
    permissions:
      contents: read
    
    steps:
    - name: Build Summary
      run: |
        echo "## 🐳 Docker Build Summary" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        
        if [[ "${{ needs.build-backend.result }}" == "success" ]]; then
          echo "✅ **Backend**: Successfully built" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ **Backend**: Build failed" >> $GITHUB_STEP_SUMMARY
        fi
        
        if [[ "${{ needs.build-frontend.result }}" == "success" ]]; then
          echo "✅ **Frontend**: Successfully built" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ **Frontend**: Build failed" >> $GITHUB_STEP_SUMMARY
        fi
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### 📦 Images" >> $GITHUB_STEP_SUMMARY
        echo "- Backend: \`${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
        echo "- Frontend: \`${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### 🏷️ Tags" >> $GITHUB_STEP_SUMMARY
        echo "Images are tagged based on:" >> $GITHUB_STEP_SUMMARY
        echo "- Branch name (for branch pushes)" >> $GITHUB_STEP_SUMMARY
        echo "- PR number (for pull requests)" >> $GITHUB_STEP_SUMMARY
        echo "- Version tags (for releases)" >> $GITHUB_STEP_SUMMARY
        echo "- Short SHA with branch prefix" >> $GITHUB_STEP_SUMMARY
        echo "- \`latest\` (for main branch)" >> $GITHUB_STEP_SUMMARY