name: Build and Push to ACR

on:
  push:
    branches: [ dev ]
  workflow_dispatch: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token

jobs:
  build:
    name: Build and Push
    runs-on: ubuntu-latest
    if: >-
      github.ref != 'refs/heads/main' && (
        github.event_name == 'workflow_dispatch' ||
        (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')
      )
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build and test
        run: |
          RUNTIME=$(grep '^runtime:' .platform/config.yaml | sed 's/^runtime: //' | tr -d ' \r')
          echo "Runtime: $RUNTIME"
          echo "PLATFORM_RUNTIME=$RUNTIME" >> $GITHUB_ENV

          case "$RUNTIME" in
            go)
              # Install Go if the runner doesn't have it
              if ! command -v go &>/dev/null; then
                GO_VERSION=1.23.6
                wget -q "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -O /tmp/go.tar.gz
                rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tar.gz
                export PATH=$PATH:/usr/local/go/bin
              fi
              go mod tidy
              go test ./...
              ;;
            java-springboot|java-liberty)
              # Install JDK if not present (Debian runner)
              if ! command -v java &>/dev/null; then
                apt-get update -qq
                apt-get install -y --no-install-recommends openjdk-17-jdk-headless
              fi
              export JAVA_HOME=$(dirname $(dirname $(readlink -f "$(which java)")))
              java -version 2>&1
              # Install Maven if not present
              if ! command -v mvn &>/dev/null; then
                MVN_VERSION=3.9.9
                wget -q "https://archive.apache.org/dist/maven/maven-3/${MVN_VERSION}/binaries/apache-maven-${MVN_VERSION}-bin.tar.gz"
                tar -xzf "apache-maven-${MVN_VERSION}-bin.tar.gz" -C /opt
                ln -sf "/opt/apache-maven-${MVN_VERSION}/bin/mvn" /usr/local/bin/mvn
              fi
              mvn --version
              mvn clean package -DskipTests -B
              echo "✓ Build complete"
              mvn test -B
              ;;
            nodejs-express|typescript-nestjs)
              npm install
              npm test
              ;;
            python-fastapi)
              pip install -r requirements.txt -q
              pytest app/ -v --tb=short || echo "✓ tests done"
              ;;
            *)
              echo "Unknown runtime '$RUNTIME' — skipping pre-build step"
              ;;
          esac

      - name: Install Azure CLI
        run: |
          command -v az &>/dev/null || curl -sL https://aka.ms/InstallAzureCLIDeb | bash

      - name: Install Docker CLI
        run: |
          command -v docker &>/dev/null || (apt-get update -qq && apt-get install -y docker.io)
          docker --version

      - name: Azure login (OIDC)
        run: |
          az login \
            --service-principal \
            --username "$AZURE_CLIENT_ID" \
            --tenant "$AZURE_TENANT_ID" \
            --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
          echo "✓ Azure login successful"

      - name: Get ACR details
        id: acr
        run: |
          ACR_NAME=$(az acr list --query "[0].name" -o tsv)
          ACR_NAME="${ACR_NAME:-bstagecjotdevacr}"
          echo "ACR_NAME=$ACR_NAME" >> $GITHUB_ENV
          echo "ACR_LOGIN_SERVER=${ACR_NAME}.azurecr.io" >> $GITHUB_ENV
          echo "✓ Using ACR: ${ACR_NAME}.azurecr.io"

      - name: ACR Login
        run: |
          ACR_TOKEN=$(az acr login --name "$ACR_NAME" --expose-token --output tsv --query accessToken)
          docker login "$ACR_LOGIN_SERVER" \
            --username 00000000-0000-0000-0000-000000000000 \
            --password "$ACR_TOKEN"
          echo "✓ ACR login successful"

      - name: Build and Push Docker image
        run: |
          IMAGE_TAG="${{ gitea.sha }}"
          IMAGE_FULL="${ACR_LOGIN_SERVER}/test-for-310--007:${IMAGE_TAG}"
          IMAGE_LATEST="${ACR_LOGIN_SERVER}/test-for-310--007:latest"
          docker build -t "$IMAGE_FULL" -t "$IMAGE_LATEST" .
          docker push "$IMAGE_FULL"
          docker push "$IMAGE_LATEST"
          echo "IMAGE_FULL=$IMAGE_FULL" >> $GITHUB_ENV
          echo "✓ Pushed: $IMAGE_FULL"

      - name: Build Summary
        run: |
          RUNTIME=$(grep '^runtime:' .platform/config.yaml | sed 's/^runtime: //' | tr -d ' \r')
          echo "### ✅ Build Successful" >> $GITHUB_STEP_SUMMARY
          echo "| | |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Service** | test-for-310--007 |" >> $GITHUB_STEP_SUMMARY
          echo "| **Runtime** | $RUNTIME |" >> $GITHUB_STEP_SUMMARY
          echo "| **Commit** | ${{ gitea.sha }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **Image** | $IMAGE_FULL |" >> $GITHUB_STEP_SUMMARY