openova/.github/workflows/catalyst-build.yaml

name: Build & Deploy Catalyst

on:
  workflow_dispatch:
  schedule:
    - cron: '0 3 * * *'  # daily at 03:00 UTC — picks up public repo changes

env:
  REGISTRY: ghcr.io
  UI_IMAGE: ghcr.io/openova-io/openova/catalyst-ui
  API_IMAGE: ghcr.io/openova-io/openova/catalyst-api

jobs:
  build-ui:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      sha_short: ${{ steps.vars.outputs.sha_short }}
    steps:
      - name: Checkout openova-private
        uses: actions/checkout@v4

      - name: Checkout openova (public source)
        uses: actions/checkout@v4
        with:
          repository: openova-io/openova
          path: openova-src

      - name: Set short SHA
        id: vars
        run: echo "sha_short=$(echo $GITHUB_SHA | head -c 7)" >> "$GITHUB_OUTPUT"

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build UI image (test)
        uses: docker/build-push-action@v6
        with:
          context: openova-src/products/catalyst/bootstrap/ui
          file: openova-src/products/catalyst/bootstrap/ui/Containerfile
          push: false
          load: true
          tags: ${{ env.UI_IMAGE }}:test
          build-args: VITE_APP_MODE=selfhosted

      - name: Smoke test UI
        run: |
          docker run -d --name smoke-ui -p 8080:8080 ${{ env.UI_IMAGE }}:test
          sleep 3
          STATUS=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/)
          if [ "$STATUS" != "200" ]; then
            echo "Smoke test failed: expected 200 from /, got $STATUS"
            docker stop smoke-ui
            exit 1
          fi
          echo "Smoke test (root) passed: HTTP $STATUS"

          # Logo path regression guard (#173): the wizard's StepComponents
          # references `${BASE}component-logos/<id>.<ext>` where BASE is the
          # Vite base and the extension is whatever the upstream brand mark
          # is published as (some are SVG, some are PNG — we use the canonical
          # upstream asset rather than auto-converting). Inside the catalyst-
          # ui pod nginx serves the file at /component-logos/<id>.<ext>
          # (Traefik strips /sovereign before proxying — see nginx.conf
          # comment). We list every logo path that componentGroups.ts
          # references, so a missing or mis-cased asset fails the build,
          # not the user.
          for path in \
              component-logos/cilium.svg \
              component-logos/flux.svg \
              component-logos/harbor.svg \
              component-logos/grafana.svg \
              component-logos/keycloak.svg \
              component-logos/openbao.svg \
              component-logos/langfuse.png \
              component-logos/vllm.png \
              component-logos/temporal.svg \
              component-logos/stalwart.svg \
              component-logos/cnpg.svg \
              component-logos/loki.png \
              component-logos/mimir.png \
              component-logos/tempo.png \
              component-logos/ntfy.png \
              component-logos/ferretdb.png \
              component-logos/openmeter.png \
              component-logos/coraza.png \
              component-logos/external-dns.png \
              component-logos/netbird.png \
              component-logos/strongswan.png \
              component-logos/trivy.png \
              component-logos/syft-grype.png ; do
            CODE=$(curl -s -o /dev/null -w '%{http_code}' \
              "http://localhost:8080/${path}")
            if [ "$CODE" != "200" ]; then
              echo "Logo smoke FAILED: /${path} returned $CODE"
              docker stop smoke-ui
              exit 1
            fi
            echo "Logo smoke OK: /${path} HTTP $CODE"
          done

          docker stop smoke-ui
          echo "All smoke tests passed."          

      - name: Push UI image
        uses: docker/build-push-action@v6
        with:
          context: openova-src/products/catalyst/bootstrap/ui
          file: openova-src/products/catalyst/bootstrap/ui/Containerfile
          push: true
          tags: |
            ${{ env.UI_IMAGE }}:${{ steps.vars.outputs.sha_short }}
            ${{ env.UI_IMAGE }}:latest            
          build-args: VITE_APP_MODE=selfhosted

  build-api:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      sha_short: ${{ steps.vars.outputs.sha_short }}
    steps:
      - name: Checkout openova-private
        uses: actions/checkout@v4

      - name: Checkout openova (public source)
        uses: actions/checkout@v4
        with:
          repository: openova-io/openova
          path: openova-src

      - name: Set short SHA
        id: vars
        run: echo "sha_short=$(echo $GITHUB_SHA | head -c 7)" >> "$GITHUB_OUTPUT"

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@v6
        with:
          context: openova-src/products/catalyst/bootstrap/api
          file: openova-src/products/catalyst/bootstrap/api/Containerfile
          push: true
          tags: |
            ${{ env.API_IMAGE }}:${{ steps.vars.outputs.sha_short }}
            ${{ env.API_IMAGE }}:latest            

  deploy:
    needs: [build-ui, build-api]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Update deployment manifests with new SHA tags
        env:
          SHA_SHORT: ${{ needs.build-ui.outputs.sha_short }}
        run: |
          DEPLOY_DIR="products/catalyst/chart/templates"

          sed -i "s|image: ${UI_IMAGE}:.*|image: ${UI_IMAGE}:${SHA_SHORT}|" \
            "${DEPLOY_DIR}/ui-deployment.yaml"

          sed -i "s|image: ${API_IMAGE}:.*|image: ${API_IMAGE}:${SHA_SHORT}|" \
            "${DEPLOY_DIR}/api-deployment.yaml"

          echo "Updated manifests to SHA ${SHA_SHORT}:"
          grep "image:" "${DEPLOY_DIR}/ui-deployment.yaml"
          grep "image:" "${DEPLOY_DIR}/api-deployment.yaml"          

      - name: Commit and push manifest updates
        env:
          SHA_SHORT: ${{ needs.build-ui.outputs.sha_short }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add products/
          git diff --staged --quiet && echo "No changes to commit" && exit 0
          git commit -m "deploy: update catalyst images to ${SHA_SHORT}"
          git push