From a9d8fb5297ca2229775f321f4ae746b8cab9da8e Mon Sep 17 00:00:00 2001
From: Xor290 <free6nk33@gmail.com>
Date: Sat, 2 May 2026 17:58:09 +0200
Subject: [PATCH] ci: add CD pipeline with Docker Hub push on pre-prod

---
 .github/workflows/backend-build.yml      | 49 +++++++++++++++++++-----
 .github/workflows/frontend-web-build.yml | 38 ++++++++++++++----
 docker/docker-compose-prod.yml           | 29 ++++++--------
 3 files changed, 83 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index debfa78c..37f0494a 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -2,13 +2,13 @@ name: Backend - Build & Lint
 
 on:
     push:
-        branches: [main]
+        branches: [pre-prod]
         paths:
-            - "backend/**/**"
+            - "backend/**"
     pull_request:
-        branches: [main]
+        branches: [pre-prod]
         paths:
-            - "backend/**/**"
+            - "backend/**"
 
 jobs:
     lint:
@@ -54,9 +54,40 @@ jobs:
               working-directory: backend/gestion
               run: go build -v ./...
 
-            - name: Upload binary
-              uses: actions/upload-artifact@v4
+    docker:
+        name: Docker Build & Push
+        needs: build
+        runs-on: ubuntu-latest
+        if: github.event_name == 'push' && github.ref == 'refs/heads/pre-prod'
+
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Login to Docker Hub
+              uses: docker/login-action@v3
               with:
-                  name: backend-binary
-                  path: backend/gestion/gestion
-                  retention-days: 7
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            - name: Build & push backend (runtime)
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  file: docker/backend/Dockerfile
+                  target: runtime
+                  push: true
+                  tags: |
+                      xor1234/backend-mln:latest
+
+            - name: Build & push WAF
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  file: docker/backend/Dockerfile
+                  target: waf
+                  push: true
+                  tags: |
+                      xor1234/backend-mln:waf
diff --git a/.github/workflows/frontend-web-build.yml b/.github/workflows/frontend-web-build.yml
index e8e69536..fc969208 100644
--- a/.github/workflows/frontend-web-build.yml
+++ b/.github/workflows/frontend-web-build.yml
@@ -2,13 +2,15 @@ name: Frontend Web - Build & Lint
 
 on:
     push:
-        branches: [main]
+        branches: [pre-prod]
         paths:
             - "frontend-prep/**"
+            - "docker/frontend/**"
     pull_request:
-        branches: [main]
+        branches: [pre-prod]
         paths:
             - "frontend-prep/**"
+            - "docker/frontend/**"
 
 jobs:
     lint-typecheck:
@@ -62,9 +64,31 @@ jobs:
                   VITE_TOMTOM_API_KEY: ${{ secrets.VITE_TOMTOM_API_KEY }}
               run: npm run build
 
-            - name: Upload dist artifact
-              uses: actions/upload-artifact@v4
+    docker:
+        name: Docker Build & Push
+        needs: build
+        runs-on: ubuntu-latest
+        if: github.event_name == 'push' && github.ref == 'refs/heads/pre-prod'
+
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Login to Docker Hub
+              uses: docker/login-action@v3
               with:
-                  name: frontend-web-dist
-                  path: frontend-prep/dist
-                  retention-days: 7
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            - name: Build & push frontend
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  file: docker/frontend/Dockerfile
+                  push: true
+                  tags: |
+                      xor1234/frontend-mln:latest
+                  build-args: |
+                      VITE_TOMTOM_API_KEY=${{ secrets.VITE_TOMTOM_API_KEY }}
diff --git a/docker/docker-compose-prod.yml b/docker/docker-compose-prod.yml
index f1dcf212..cc560b93 100644
--- a/docker/docker-compose-prod.yml
+++ b/docker/docker-compose-prod.yml
@@ -1,13 +1,9 @@
 services:
-
     # =========================================================
     # Backend Go
     # =========================================================
     backend:
-        build:
-            context: ..
-            dockerfile: docker/backend/Dockerfile
-            target: runtime
+        image: xor1234/backend-mln:latest
         container_name: gestion-backend
         restart: unless-stopped
         environment:
@@ -44,9 +40,7 @@ services:
     # Frontend Web (React/Vite — servi en HTTP interne)
     # =========================================================
     frontend:
-        build:
-            context: ..
-            dockerfile: docker/frontend/Dockerfile
+        image: xor1234/frontend-mln:latest
         container_name: gestion-frontend
         restart: unless-stopped
         networks:
@@ -54,16 +48,8 @@ services:
         depends_on:
             - backend
 
-    # =========================================================
-    # WAF (Nginx + ModSecurity) — point d'entrée public
-    # Les certificats fullchain.pem + privkey.pem doivent être
-    # placés dans ./certs/ à côté de ce fichier avant le deploy.
-    # =========================================================
     waf:
-        build:
-            context: ..
-            dockerfile: docker/backend/Dockerfile
-            target: waf
+        image: xor1234/backend-mln:waf
         container_name: gestion-waf
         restart: unless-stopped
         environment:
@@ -143,6 +129,15 @@ services:
             retries: 5
             start_period: 10s
 
+    dozzle-agent:
+        image: amir20/dozzle:latest
+        command: agent
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+        ports:
+            - "7007:7007"
+        restart: unless-stopped
+
 networks:
     gestion-network:
         driver: bridge