formulation/.gitea/workflows/build-and-push-image.yaml

name: Build & Deploy Formulation

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  build:
    name: 'Build & Push Image'
    env:
      REGISTRY_USERNAME: nicholas
      IMAGE_REGISTRY: git.uuard.com
      IMAGE_NAME: nicholas/formulation
      IMAGE_TAG: ${{ github.sha }}
    runs-on: shared-ci
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v4

      - name: ⚙️ Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm

      - name: ✅ Validate recipe data
        run: |
          python3 -m venv .venv
          .venv/bin/pip install -r requirements-dev.txt
          .venv/bin/python scripts/validate-content

      - name: 🔐 Gitea Registry Login
        uses: docker/login-action@v3
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ env.REGISTRY_USERNAME }}
          password: ${{ secrets.CD_CD_BUILD_PUSH }}

      - name: 🐋 Build Docker image
        run: docker build -t $IMAGE_REGISTRY/$IMAGE_NAME:$IMAGE_TAG .

      - name: 🚀 Push Docker image
        run: docker push $IMAGE_REGISTRY/$IMAGE_NAME:$IMAGE_TAG

      - name: 🧹 Prune images
        if: always()
        run: docker image prune -f

  deploy:
    needs: build
    runs-on: recipe-book-deploy
    env:
      IMAGE_TAG: ${{ github.sha }}
    steps:
      - name: ⬇️ Checkout repo
        uses: actions/checkout@v4

      - name: Install kubectl
        env:
          KUBECTL_VERSION: v1.36.2
        run: |
          set -euo pipefail
          curl -fsSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          curl -fsSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
          printf '%s  %s\n' "$(cat kubectl.sha256)" kubectl | sha256sum -c
          mkdir -p "$HOME/.local/bin"
          install -m 0755 kubectl "$HOME/.local/bin/kubectl"
          printf '%s\n' "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Configure Kubernetes access
        env:
          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
        run: |
          set -euo pipefail
          mkdir -p ~/.kube
          printf '%s' "$KUBE_CONFIG" | base64 -d > ~/.kube/config
          chmod 600 ~/.kube/config
          kubectl auth can-i update deployments --namespace nicholas

      - name: Deploy Formulation read-only viewer
        run: |
          set -euo pipefail
          sed -E -i "s#newTag: \"[0-9a-f]+\"#newTag: \"${IMAGE_TAG}\"#" k8s/kustomization.yaml
          grep -q "newTag: \"${IMAGE_TAG}\"$" k8s/kustomization.yaml
          kubectl apply --kustomize k8s
          if ! kubectl rollout status deployment/recipe-book \
            --namespace nicholas --timeout=180s; then
            kubectl rollout undo deployment/recipe-book --namespace nicholas
            kubectl rollout status deployment/recipe-book \
              --namespace nicholas --timeout=180s
            exit 1
          fi