name: Backend - Build & Lint

on:
    push:
        branches: [main, pre-prod]
        paths:
            - "backend/**/**"
    pull_request:
        branches: [main, pre-prod]
        paths:
            - "backend/**/**"

jobs:
    build:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v4

            - name: Setup Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24.4"
                  cache-dependency-path: backend/gestion/go.sum

            - name: Download dependencies
              working-directory: backend/gestion
              run: go mod download

            - name: golangci-lint
              uses: golangci/golangci-lint-action@v6
              continue-on-error: true
              with:
                  version: latest
                  working-directory: backend/gestion
                  args: --timeout=5m

            - name: Install & run gosec
              working-directory: backend/gestion
              continue-on-error: true
              run: |
                  go install github.com/securego/gosec/v2/cmd/gosec@latest
                  gosec ./...

            - name: Build
              working-directory: backend/gestion
              run: go build -v ./...

            - name: Upload binary
              uses: actions/upload-artifact@v4
              with:
                  name: backend-binary
                  path: backend/gestion/gestion
                  retention-days: 7

            - name: Login to Docker Hub
              if: github.event_name == 'push'
              uses: docker/login-action@v3
              with:
                  username: ${{ secrets.DOCKERHUB_USERNAME }}
                  password: ${{ secrets.DOCKERHUB_TOKEN }}

            - name: Set up Docker Buildx
              if: github.event_name == 'push'
              uses: docker/setup-buildx-action@v3

            - name: Build & push backend (runtime)
              if: github.event_name == 'push'
              uses: docker/build-push-action@v6
              with:
                  context: .
                  file: docker-pre-prod/backend/Dockerfile
                  target: runtime
                  push: true
                  tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'latest' || 'pre-prod' }}

            - name: Build & push WAF
              if: github.event_name == 'push'
              uses: docker/build-push-action@v6
              with:
                  context: .
                  file: docker-prod/backend/Dockerfile
                  target: waf
                  push: true
                  tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'waf' || 'waf-pre-prod' }}

            - name: SSH Deploy
              if: github.event_name == 'push'
              uses: appleboy/ssh-action@v1
              with:
                  host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
                  username: ${{ secrets.SERVER_USER }}
                  key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY_PRE_PROD }}
                  script: |
                      docker compose -f ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.COMPOSE_PATH_PROD || secrets.COMPOSE_PATH_PRE_PROD }} pull backend waf
                      docker compose -f ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.COMPOSE_PATH_PROD || secrets.COMPOSE_PATH_PRE_PROD }} up -d --no-deps backend waf