LoreMind/.gitea/workflows/release.yml

name: Build & Push Images

on:
  push:
    tags:
      - 'v*'

env:
  GITEA_REGISTRY: git.igmlcreation.fr
  GITEA_REGISTRY_USER: ietm64
  GHCR_REGISTRY: ghcr.io
  GHCR_NAMESPACE: igmlcreation

jobs:
  # GATE : aucune image n'est build/push tant que les 3 suites unitaires
  # (Java / Python / Angular) ne passent pas. Un tag posé sur un commit aux
  # tests rouges ne publiera donc PAS d'images.
  tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: maven
      - name: Core — mvn test (+ JaCoCo check)
        working-directory: core
        run: mvn -B test

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip
          cache-dependency-path: brain/requirements-dev.txt
      - name: Brain — pytest (+ couverture)
        working-directory: brain
        run: |
          pip install -r requirements-dev.txt
          pytest --cov=app --cov-report=term-missing --cov-fail-under=50

      - name: Set up Node 20
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: web/package-lock.json
      - name: Web — vitest (+ couverture)
        working-directory: web
        run: |
          npm ci --no-audit --no-fund
          npm run test:unit:coverage

  build:
    needs: tests
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        component: [brain, core, web]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GITEA_REGISTRY }}
          username: ${{ env.GITEA_REGISTRY_USER }}
          password: ${{ secrets.DOCKER_PAT }}

      # Login to GHCR (GitHub Container Registry) pour distribuer les images
      # publiquement aux utilisateurs finaux. Reputation domaine plus elevee
      # que git.igmlcreation.fr (mieux pour les antivirus / SmartScreen).
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ env.GHCR_NAMESPACE }}
          password: ${{ secrets.GHCR_TOKEN }}

      # Detection du canal :
      #   - tag vX.Y.Z         -> stable (push :latest + :version sur les repos publics)
      #   - tag vX.Y.Z-beta*   -> beta  (push :beta + :version sur les repos GHCR prives
      #                                  loremind-beta-<component> ; backup Gitea avec :version)
      - name: Extract version & channel
        id: meta
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          if [[ "${VERSION}" == *-beta* ]]; then
            echo "channel=beta" >> $GITHUB_OUTPUT
          else
            echo "channel=stable" >> $GITHUB_OUTPUT
          fi

      # Build & push canal STABLE
      - name: Build & push ${{ matrix.component }} (stable)
        if: steps.meta.outputs.channel == 'stable'
        uses: docker/build-push-action@v5
        with:
          context: ./${{ matrix.component }}
          push: true
          tags: |
            ${{ env.GITEA_REGISTRY }}/${{ env.GITEA_REGISTRY_USER }}/${{ matrix.component }}:latest
            ${{ env.GITEA_REGISTRY }}/${{ env.GITEA_REGISTRY_USER }}/${{ matrix.component }}:${{ steps.meta.outputs.version }}
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_NAMESPACE }}/loremind-${{ matrix.component }}:latest
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_NAMESPACE }}/loremind-${{ matrix.component }}:${{ steps.meta.outputs.version }}

      # Build & push canal BETA
      # GHCR : repos prives loremind-beta-<component> (gated par PAT distribue
      #        via le relais Patreon aux tiers Compagnon).
      # Gitea : backup prive avec :version uniquement (pas de :latest pour ne
      #         pas faire upgrader les installs branchees sur Gitea).
      - name: Build & push ${{ matrix.component }} (beta)
        if: steps.meta.outputs.channel == 'beta'
        uses: docker/build-push-action@v5
        with:
          context: ./${{ matrix.component }}
          push: true
          tags: |
            ${{ env.GITEA_REGISTRY }}/${{ env.GITEA_REGISTRY_USER }}/${{ matrix.component }}:${{ steps.meta.outputs.version }}
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_NAMESPACE }}/loremind-beta-${{ matrix.component }}:beta
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_NAMESPACE }}/loremind-beta-${{ matrix.component }}:${{ steps.meta.outputs.version }}

  # Job separe pour le sidecar `switcher`.
  # Pourquoi separe : le switcher est volontairement HORS de IMAGE_NAMESPACE
  # (cf. docker-compose.yml). Il est toujours pulle depuis le repo public
  # `loremind-switcher`, quel que soit le canal de l'instance. On le build
  # donc uniquement sur les releases stables — pas la peine de re-publier
  # une variante beta du switcher, c'est une infrastructure neutre.
  build-switcher:
    needs: tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Detect channel
        id: meta
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          if [[ "${VERSION}" == *-beta* ]]; then
            echo "channel=beta" >> $GITHUB_OUTPUT
          else
            echo "channel=stable" >> $GITHUB_OUTPUT
          fi

      - name: Login to Gitea Registry
        if: steps.meta.outputs.channel == 'stable'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GITEA_REGISTRY }}
          username: ${{ env.GITEA_REGISTRY_USER }}
          password: ${{ secrets.DOCKER_PAT }}

      - name: Login to GHCR
        if: steps.meta.outputs.channel == 'stable'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ env.GHCR_NAMESPACE }}
          password: ${{ secrets.GHCR_TOKEN }}

      - name: Build & push switcher (stable only)
        if: steps.meta.outputs.channel == 'stable'
        uses: docker/build-push-action@v5
        with:
          context: ./switcher
          push: true
          tags: |
            ${{ env.GITEA_REGISTRY }}/${{ env.GITEA_REGISTRY_USER }}/switcher:latest
            ${{ env.GITEA_REGISTRY }}/${{ env.GITEA_REGISTRY_USER }}/switcher:${{ steps.meta.outputs.version }}
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_NAMESPACE }}/loremind-switcher:latest
            ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_NAMESPACE }}/loremind-switcher:${{ steps.meta.outputs.version }}