name: Build catalyst-catalog

# catalyst-catalog — multi-source Blueprint catalog HTTP REST service
# (EPIC-2 Slice L of #1097). REPLACES the per-Org SME catalog per
# ADR-0001 §4.3.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4a "GitHub Actions is the only
# build path" — this workflow is the canonical (and only) way to
# produce a `ghcr.io/openova-io/openova/catalyst-catalog:<sha>` image.
#
# Trigger model is event-driven per the openova-private CLAUDE.md
# coupled rule: push-on-main is the canonical trigger; workflow_dispatch
# is the manual override for ad-hoc rebuilds. NO cron.
#
# Path filter watches:
#   - core/services/catalyst-catalog/**       (the service itself)
#   - core/controllers/pkg/gitea/**           (the imported Gitea client)
#   - core/controllers/go.mod                 (replaced module)
#   - core/controllers/go.sum                 (replaced module)
#   - .github/workflows/catalyst-catalog-build.yaml (this file)

on:
  push:
    paths:
      - 'core/services/catalyst-catalog/**'
      - 'core/controllers/pkg/gitea/**'
      - 'core/controllers/go.mod'
      - 'core/controllers/go.sum'
      - '.github/workflows/catalyst-catalog-build.yaml'
    branches: [main]
  workflow_dispatch:
  pull_request:
    paths:
      - 'core/services/catalyst-catalog/**'
      - 'core/controllers/pkg/gitea/**'
      - 'core/controllers/go.mod'
      - 'core/controllers/go.sum'
      - '.github/workflows/catalyst-catalog-build.yaml'

env:
  REGISTRY: ghcr.io
  IMAGE: ghcr.io/openova-io/openova/catalyst-catalog

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.23'
          cache-dependency-path: |
            core/services/catalyst-catalog/go.sum
            core/controllers/go.sum

      - name: go vet (catalog service)
        working-directory: core/services/catalyst-catalog
        run: go vet ./...

      - name: go test (catalog service, race + count=1)
        working-directory: core/services/catalyst-catalog
        # Race + count=1 catches flakes that a cached run would hide.
        # Tests use httptest fakes (no real Gitea required).
        run: go test -count=1 -race ./...

      - name: go vet (gitea client — promoted to pkg/)
        working-directory: core/controllers
        # The Gitea client lives in core/controllers/pkg/gitea — exercising
        # vet here ensures the promotion path stays linkable.
        run: go vet ./pkg/gitea/...

      - name: go test (gitea client)
        working-directory: core/controllers
        run: go test -count=1 -race ./pkg/gitea/...

  build:
    needs: test
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    outputs:
      sha_short: ${{ steps.vars.outputs.sha_short }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set short SHA
        id: vars
        run: echo "sha_short=$(echo $GITHUB_SHA | head -c 7)" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        id: build
        uses: docker/build-push-action@v6
        with:
          # Build context is the repository root so the Containerfile's
          # COPY paths can reach BOTH core/services/catalyst-catalog/
          # AND core/controllers/pkg/gitea/ (the replaced module that
          # supplies the unified Gitea client).
          context: .
          file: core/services/catalyst-catalog/Containerfile
          push: true
          # SHA-pinned tags. Two emitted:
          #   :<short-sha>   — what cluster manifests reference
          #   :<full-sha>    — long form for audit trails
          tags: |
            ${{ env.IMAGE }}:${{ steps.vars.outputs.sha_short }}
            ${{ env.IMAGE }}:${{ github.sha }}
          provenance: false

  notify:
    needs: build
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Trigger downstream chart-bump
        # Same repository_dispatch pattern as the other Group C controllers'
        # workflows (see useraccess-controller-build.yaml for the canonical
        # template). The downstream chart-bump workflow stamps the SHA
        # into products/catalyst/chart/values.yaml services.catalog.image.tag
        # and opens the bump PR for review.
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          event-type: catalyst-catalog-image-built
          client-payload: |
            {
              "sha_short": "${{ needs.build.outputs.sha_short }}",
              "digest": "${{ needs.build.outputs.digest }}",
              "git_sha": "${{ github.sha }}"
            }
