ci-docker.yml

name: CI & Docker (GCP Cloud Run)

on:
  push:
    branches:
      - main
      - lorenc-ci
      - lorenc-cicd
      - paython-mcp
      - feature/configure-chat-ui
  pull_request:
    branches:
      - main

# Avoid overlapping deploys for the same ref
concurrency:
  group: mcp-cicd-${{ github.ref }}
  cancel-in-progress: true

# Common env values
env:
  NODE_VERSION: 20
  REGION: ${{ secrets.GCP_REGION }}
  PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
  AR_HOST: us-east1-docker.pkg.dev

  BACKEND_IMAGE_NAME: mcp-backend
  FRONTEND_IMAGE_NAME: mcp-frontend

  BACKEND_AR_REPO: mcp-backend
  FRONTEND_AR_REPO: mcp-frontend

  BACKEND_SERVICE: mcp-backend
  FRONTEND_SERVICE: mcp-frontend

jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: |
          cd server
          npm ci

      - name: Run tests
        run: |
          cd server
          npm test --if-present

  build-backend:
    needs: build-test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Compute lowercase owner
        id: vars
        shell: bash
        run: |
          OWNER_LC="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
          echo "owner_lc=$OWNER_LC" >> "$GITHUB_OUTPUT"

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build backend image
        shell: bash
        run: |
          BACKEND_GHCR="ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ env.BACKEND_IMAGE_NAME }}"
          VERSION="${{ github.sha }}"

          echo "BACKEND_GHCR=$BACKEND_GHCR" >> "$GITHUB_ENV"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

          docker build -t "$BACKEND_GHCR:$VERSION" -t "$BACKEND_GHCR:latest" .

      - name: Push backend image
        run: |
          docker push "$BACKEND_GHCR:$VERSION"
          docker push "$BACKEND_GHCR:latest"

  build-frontend:
    needs: build-test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Compute lowercase owner
        id: vars
        shell: bash
        run: |
          OWNER_LC="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
          echo "owner_lc=$OWNER_LC" >> "$GITHUB_OUTPUT"

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build frontend image
        shell: bash
        run: |
          FRONTEND_GHCR="ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ env.FRONTEND_IMAGE_NAME }}"
          VERSION="${{ github.sha }}"

          echo "FRONTEND_GHCR=$FRONTEND_GHCR" >> "$GITHUB_ENV"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

          docker build -f Dockerfile.frontend -t "$FRONTEND_GHCR:$VERSION" -t "$FRONTEND_GHCR:latest" .

      - name: Push frontend image
        run: |
          docker push "$FRONTEND_GHCR:$VERSION"
          docker push "$FRONTEND_GHCR:latest"

  deploy-backend:
    needs: build-backend
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Compute lowercase owner
        id: vars
        shell: bash
        run: |
          OWNER_LC="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
          echo "owner_lc=$OWNER_LC" >> "$GITHUB_OUTPUT"

      # NOTE: Using SA key json for now (works). Upgrade to OIDC/WIF later.
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}

      - name: Debug GCP env
        run: |
          echo "PROJECT_ID=${{ env.PROJECT_ID }}"
          echo "REGION=${{ env.REGION }}"

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ env.PROJECT_ID }}

      - name: Configure Docker for Artifact Registry
        run: |
          gcloud auth configure-docker ${{ env.AR_HOST }} --quiet

      - name: Pull backend image from GHCR
        shell: bash
        run: |
          BACKEND_GHCR="ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ env.BACKEND_IMAGE_NAME }}"
          VERSION="${{ github.sha }}"

          echo "BACKEND_GHCR=$BACKEND_GHCR" >> "$GITHUB_ENV"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
          docker pull "$BACKEND_GHCR:$VERSION"

      - name: Tag & push backend image to Artifact Registry
        shell: bash
        run: |
          BACKEND_AR_IMAGE="${{ env.AR_HOST }}/${{ env.PROJECT_ID }}/${{ env.BACKEND_AR_REPO }}/${{ env.BACKEND_IMAGE_NAME }}"
          echo "BACKEND_AR_IMAGE=$BACKEND_AR_IMAGE" >> "$GITHUB_ENV"

          docker tag "$BACKEND_GHCR:$VERSION" "$BACKEND_AR_IMAGE:$VERSION"
          docker push "$BACKEND_AR_IMAGE:$VERSION"

      - name: Deploy backend to Cloud Run
        run: |
          gcloud run deploy "${{ env.BACKEND_SERVICE }}" \
            --image "$BACKEND_AR_IMAGE:$VERSION" \
            --region "${{ env.REGION }}" \
            --platform managed \
            --allow-unauthenticated \
            --port 3000 \
            --quiet

  deploy-frontend:
    needs: build-frontend
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Compute lowercase owner
        id: vars
        shell: bash
        run: |
          OWNER_LC="$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
          echo "owner_lc=$OWNER_LC" >> "$GITHUB_OUTPUT"

      # NOTE: Using SA key json for now (works). Upgrade to OIDC/WIF later.
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}

      - name: Debug GCP env
        run: |
          echo "PROJECT_ID=${{ env.PROJECT_ID }}"
          echo "REGION=${{ env.REGION }}"

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ env.PROJECT_ID }}

      - name: Configure Docker for Artifact Registry
        run: |
          gcloud auth configure-docker ${{ env.AR_HOST }} --quiet

      - name: Pull frontend image from GHCR
        shell: bash
        run: |
          FRONTEND_GHCR="ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ env.FRONTEND_IMAGE_NAME }}"
          VERSION="${{ github.sha }}"

          echo "FRONTEND_GHCR=$FRONTEND_GHCR" >> "$GITHUB_ENV"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
          docker pull "$FRONTEND_GHCR:$VERSION"

      - name: Tag & push frontend image to Artifact Registry
        shell: bash
        run: |
          FRONTEND_AR_IMAGE="${{ env.AR_HOST }}/${{ env.PROJECT_ID }}/${{ env.FRONTEND_AR_REPO }}/${{ env.FRONTEND_IMAGE_NAME }}"
          echo "FRONTEND_AR_IMAGE=$FRONTEND_AR_IMAGE" >> "$GITHUB_ENV"

          docker tag "$FRONTEND_GHCR:$VERSION" "$FRONTEND_AR_IMAGE:$VERSION"
          docker push "$FRONTEND_AR_IMAGE:$VERSION"

      - name: Deploy frontend to Cloud Run
        run: |
          gcloud run deploy "${{ env.FRONTEND_SERVICE }}" \
            --image "$FRONTEND_AR_IMAGE:$VERSION" \
            --region "${{ env.REGION }}" \
            --platform managed \
            --allow-unauthenticated \
            --port 80 \
            --quiet