name: Build Docker Images (Hetzner)

on:
  push:
    branches: [main]
    paths:
      - 'packages/backend/**'
      - 'packages/frontend/**'
      - 'Dockerfile*'
  workflow_dispatch:

jobs:
  build:
    name: Build on Hetzner
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install hcloud CLI
        run: |
          curl -sL https://github.com/hetznercloud/cli/releases/latest/download/hcloud-linux-amd64.tar.gz | tar xz
          sudo mv hcloud /usr/local/bin/

      - name: Create build VM
        id: vm
        env:
          HCLOUD_TOKEN: ${{ '{{' }} secrets.HCLOUD_TOKEN {{ '}}' }}
        run: |
          BUILD_NAME="{{ project_name }}-build-${{ '{{' }} github.run_id {{ '}}' }}"
          SERVER_JSON=$(hcloud server create \
            --name "$BUILD_NAME" \
            --type {{ build_server_type }} \
            --location {{ build_location }} \
            --image ubuntu-24.04 \
            --label managed-by=prisme \
            --label purpose=docker-build \
            -o json)

          SERVER_ID=$(echo "$SERVER_JSON" | jq -r '.server.id')
          echo "server_id=$SERVER_ID" >> "$GITHUB_OUTPUT"
          echo "build_name=$BUILD_NAME" >> "$GITHUB_OUTPUT"

          # Wait for server to be ready
          echo "Waiting for server..."
          sleep 30
          SERVER_IP=$(hcloud server ip "$BUILD_NAME")
          echo "server_ip=$SERVER_IP" >> "$GITHUB_OUTPUT"

      - name: Build and push images
        env:
          HCLOUD_TOKEN: ${{ '{{' }} secrets.HCLOUD_TOKEN {{ '}}' }}
        run: |
          SERVER_IP="${{ '{{' }} steps.vm.outputs.server_ip {{ '}}' }}"

          # Copy source to build server
          rsync -az --exclude='.git' -e "ssh -o StrictHostKeyChecking=no" . root@$SERVER_IP:/build/

          # Build on remote server
          ssh -o StrictHostKeyChecking=no root@$SERVER_IP << 'BUILD'
            cd /build

            # Login to registry
            echo "${{ '{{' }} secrets.REGISTRY_TOKEN {{ '}}' }}" | docker login {{ registry }} -u "${{ '{{' }} github.actor {{ '}}' }}" --password-stdin

            # Build backend
            docker build \
              -t {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-backend:${{ '{{' }} github.sha {{ '}}' }} \
              -t {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-backend:latest \
              {% for key, value in build_args.items() %}
              --build-arg {{ key }}={{ value }} \
              {% endfor %}
              {% if cache_from %}
              --cache-from {{ cache_from }} \
              {% endif %}
              -f Dockerfile.backend.prod .

            docker push {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-backend:${{ '{{' }} github.sha {{ '}}' }}
            docker push {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-backend:latest

            # Build frontend (if Dockerfile exists)
            if [ -f Dockerfile.frontend.prod ]; then
              docker build \
                -t {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-frontend:${{ '{{' }} github.sha {{ '}}' }} \
                -t {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-frontend:latest \
                {% for key, value in build_args.items() %}
                --build-arg {{ key }}={{ value }} \
                {% endfor %}
                -f Dockerfile.frontend.prod .

              docker push {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-frontend:${{ '{{' }} github.sha {{ '}}' }}
              docker push {{ registry }}/${{ '{{' }} github.repository {{ '}}' }}-frontend:latest
            fi
          BUILD

      - name: Destroy build VM
        if: always()
        env:
          HCLOUD_TOKEN: ${{ '{{' }} secrets.HCLOUD_TOKEN {{ '}}' }}
        run: |
          SERVER_ID="${{ '{{' }} steps.vm.outputs.server_id {{ '}}' }}"
          if [ -n "$SERVER_ID" ]; then
            hcloud server delete "$SERVER_ID" || true
          fi
