docker.yml

# Docker — 이미지 빌드 + 레지스트리 push + CVE 스캔
# 코드 품질 검증(lint/test)은 ci.yml에서 별도 실행
name: CI / Docker

on:
  push:
    branches: [develop, release]
  workflow_dispatch:
    inputs:
      force:
        description: "변경 감지를 무시하고 모든 서비스를 강제 실행"
        required: false
        default: false
        type: boolean

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.sha }}
  cancel-in-progress: false

jobs:
  # ── 변경 감지 — 서비스별 선택적 빌드를 위한 matrix 생성 ──
  detect:
    runs-on: ubuntu-latest # github-hosted runner — dorny/paths-filter만 실행하는 경량 job
    outputs:
      services: ${{ steps.set-matrix.outputs.services }}
      app: ${{ steps.flags.outputs.app }}
      meetpie: ${{ steps.flags.outputs.meetpie }}
      deskpie: ${{ steps.flags.outputs.deskpie }}
    steps:
      - uses: actions/checkout@v6

      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: .github/path-filters.yml

      - id: set-matrix
        env:
          FORCE: ${{ inputs.force || github.event_name == 'workflow_dispatch' }}
          WORKSPACE_ALL: ${{ steps.filter.outputs.workspace_all }}
          BACKEND_INFRA: ${{ steps.filter.outputs.backend_infra }}
          BACKEND_COMMON: ${{ steps.filter.outputs.backend_common }}
          BACKEND_CRYPTO: ${{ steps.filter.outputs.backend_crypto }}
          BACKEND_IAM: ${{ steps.filter.outputs.backend_iam }}
          BACKEND_NOTIFICATION: ${{ steps.filter.outputs.backend_notification }}
          BACKEND_AUDIT: ${{ steps.filter.outputs.backend_audit }}
          BACKEND_AX: ${{ steps.filter.outputs.backend_ax }}
          BACKEND_MCP: ${{ steps.filter.outputs.backend_mcp }}
          BACKEND_APP: ${{ steps.filter.outputs.backend_app }}
          BACKEND_MEETPIE: ${{ steps.filter.outputs.backend_meetpie }}
          BACKEND_DESKPIE: ${{ steps.filter.outputs.backend_deskpie }}
          BACKEND_DIST_APP: ${{ steps.filter.outputs.backend_dist_app }}
          BACKEND_DIST_MEETPIE: ${{ steps.filter.outputs.backend_dist_meetpie }}
          BACKEND_DIST_DESKPIE: ${{ steps.filter.outputs.backend_dist_deskpie }}
          FRONTEND_APP: ${{ steps.filter.outputs.frontend_app }}
          FRONTEND_APP_SHARED: ${{ steps.filter.outputs.frontend_app_shared }}
          FRONTEND_MEETPIE: ${{ steps.filter.outputs.frontend_meetpie }}
          FRONTEND_DESKPIE: ${{ steps.filter.outputs.frontend_deskpie }}
          FRONTEND_TESTS_HELPERS: ${{ steps.filter.outputs.frontend_tests_helpers }}
          FRONTEND_TESTS_BOOKING: ${{ steps.filter.outputs.frontend_tests_booking }}
          BACKEND_ONLY: ${{ steps.filter.outputs.backend_only }}
        run: bash scripts/ci-detect-services >> "$GITHUB_OUTPUT"

      - id: flags
        run: |
          SERVICES='${{ steps.set-matrix.outputs.services }}'
          echo "app=$(echo "$SERVICES"     | jq 'contains(["app"])')"     >> "$GITHUB_OUTPUT"
          echo "meetpie=$(echo "$SERVICES" | jq 'contains(["meetpie"])')" >> "$GITHUB_OUTPUT"
          echo "deskpie=$(echo "$SERVICES" | jq 'contains(["deskpie"])')" >> "$GITHUB_OUTPUT"

  # ── 서비스별 이미지 빌드 + 조건부 push ──
  build-app:
    needs: detect
    if: needs.detect.outputs.app == 'true'
    runs-on: ["os:ubuntu", "arch:arm64", "purpose:build"]
    steps:
      - uses: actions/checkout@v6

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ireg.querypie.io
          username: ${{ vars.IREG_QUERYPIE_IO_USERNAME }}
          password: ${{ secrets.IREG_QUERYPIE_IO_PASSWORD }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Compute service SHA
        id: sha
        env:
          GH_TOKEN: ${{ github.token }}
        run: echo "sha=$(./scripts/image-sha app)" >> "$GITHUB_OUTPUT"

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ireg.querypie.io/ci/deck-app
          tags: |
            type=raw,value=dev-${{ steps.sha.outputs.sha }},enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=${{ steps.sha.outputs.sha }},enable=${{ github.ref == 'refs/heads/release' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
            type=raw,value=manual-${{ steps.sha.outputs.sha }},enable=${{ github.event_name == 'workflow_dispatch' }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: SERVICE=app
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha,scope=app-${{ github.ref_name }}
            type=registry,ref=ireg.querypie.io/ci/deck-app:buildcache
          cache-to: |
            type=gha,scope=app-${{ github.ref_name }},mode=max
            ${{ github.event_name == 'push' && 'type=registry,ref=ireg.querypie.io/ci/deck-app:buildcache,mode=max' || '' }}
        env:
          BUILDKIT_PROGRESS: plain

  build-meetpie:
    needs: detect
    if: needs.detect.outputs.meetpie == 'true'
    runs-on: ["os:ubuntu", "arch:arm64", "purpose:build"]
    steps:
      - uses: actions/checkout@v6

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ireg.querypie.io
          username: ${{ vars.IREG_QUERYPIE_IO_USERNAME }}
          password: ${{ secrets.IREG_QUERYPIE_IO_PASSWORD }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Compute service SHA
        id: sha
        env:
          GH_TOKEN: ${{ github.token }}
        run: echo "sha=$(./scripts/image-sha meetpie)" >> "$GITHUB_OUTPUT"

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ireg.querypie.io/ci/deck-meetpie
          tags: |
            type=raw,value=dev-${{ steps.sha.outputs.sha }},enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=${{ steps.sha.outputs.sha }},enable=${{ github.ref == 'refs/heads/release' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
            type=raw,value=manual-${{ steps.sha.outputs.sha }},enable=${{ github.event_name == 'workflow_dispatch' }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: SERVICE=meetpie
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha,scope=meetpie-${{ github.ref_name }}
            type=registry,ref=ireg.querypie.io/ci/deck-app:buildcache
            type=registry,ref=ireg.querypie.io/ci/deck-meetpie:buildcache
          cache-to: |
            type=gha,scope=meetpie-${{ github.ref_name }},mode=max
            ${{ github.event_name == 'push' && 'type=registry,ref=ireg.querypie.io/ci/deck-meetpie:buildcache,mode=max' || '' }}
        env:
          BUILDKIT_PROGRESS: plain

  build-deskpie:
    needs: detect
    if: needs.detect.outputs.deskpie == 'true'
    runs-on: ["os:ubuntu", "arch:arm64", "purpose:build"]
    steps:
      - uses: actions/checkout@v6

      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: ireg.querypie.io
          username: ${{ vars.IREG_QUERYPIE_IO_USERNAME }}
          password: ${{ secrets.IREG_QUERYPIE_IO_PASSWORD }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Compute service SHA
        id: sha
        env:
          GH_TOKEN: ${{ github.token }}
        run: echo "sha=$(./scripts/image-sha deskpie)" >> "$GITHUB_OUTPUT"

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ireg.querypie.io/ci/deck-deskpie
          tags: |
            type=raw,value=dev-${{ steps.sha.outputs.sha }},enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/develop' }}
            type=raw,value=${{ steps.sha.outputs.sha }},enable=${{ github.ref == 'refs/heads/release' }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
            type=raw,value=manual-${{ steps.sha.outputs.sha }},enable=${{ github.event_name == 'workflow_dispatch' }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: SERVICE=deskpie
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: |
            type=gha,scope=deskpie-${{ github.ref_name }}
            type=registry,ref=ireg.querypie.io/ci/deck-app:buildcache
            type=registry,ref=ireg.querypie.io/ci/deck-deskpie:buildcache
          cache-to: |
            type=gha,scope=deskpie-${{ github.ref_name }},mode=max
            ${{ github.event_name == 'push' && 'type=registry,ref=ireg.querypie.io/ci/deck-deskpie:buildcache,mode=max' || '' }}
        env:
          BUILDKIT_PROGRESS: plain

  # ── CVE 스캔 — push 이벤트에서만, 빌드와 병렬 실행, 배포를 blocking하지 않음 ──
  scan-app:
    if: github.event_name == 'push' && needs.detect.outputs.app == 'true'
    needs: [detect, build-app]
    uses: ./.github/workflows/scan.yml
    with:
      service: app
    secrets: inherit

  scan-meetpie:
    if: github.event_name == 'push' && needs.detect.outputs.meetpie == 'true'
    needs: [detect, build-meetpie]
    uses: ./.github/workflows/scan.yml
    with:
      service: meetpie
    secrets: inherit

  scan-deskpie:
    if: github.event_name == 'push' && needs.detect.outputs.deskpie == 'true'
    needs: [detect, build-deskpie]
    uses: ./.github/workflows/scan.yml
    with:
      service: deskpie
    secrets: inherit

  # ── Dev 자동 배포 — 빌드 성공 후 서비스별 독립 트리거 ──
  deploy-dev-app:
    needs: [detect, build-app]
    if: |
      github.ref == 'refs/heads/develop' &&
      github.event_name == 'push' &&
      needs.detect.outputs.app == 'true'
    uses: ./.github/workflows/deploy-dev.yml
    with:
      service: app
      db_reset: true
    secrets: inherit

  deploy-dev-meetpie:
    needs: [detect, build-meetpie]
    if: |
      github.ref == 'refs/heads/develop' &&
      github.event_name == 'push' &&
      needs.detect.outputs.meetpie == 'true'
    uses: ./.github/workflows/deploy-dev.yml
    with:
      service: meetpie
      db_reset: true
    secrets: inherit

  deploy-dev-deskpie:
    needs: [detect, build-deskpie]
    if: |
      github.ref == 'refs/heads/develop' &&
      github.event_name == 'push' &&
      needs.detect.outputs.deskpie == 'true'
    uses: ./.github/workflows/deploy-dev.yml
    with:
      service: deskpie
      db_reset: true
    secrets: inherit