explore.yml

# explore.yml — Flutter web companion app pipeline
#
# Independent of the Rust ci.yml (which is paused during bootstrap;
# see CLAUDE.md principle 2). Scoped via `paths:` so changes outside
# apps/escurel-explore/ and the example tenant do not trigger
# Flutter setup.
#
# Triggers:
#   - workflow_dispatch (manual)
#   - push to main touching the relevant paths → build + push image
#
# Image: ghcr.io/<owner>/escurel-explore:sha-<short>
#        + ghcr.io/<owner>/escurel-explore:latest
#        + ghcr.io/<owner>/escurel-explore:main  (substrate deploy default)
#
# Operator promotes via the substrate repo's /deploy-green flow.
# Auto-promotion to Nomad is intentionally deferred until the
# substrate's API token + workflow are wired up.

name: explore

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - 'apps/escurel-explore/**'
      - 'packages/escurel_explorer_kit/**'
      - 'examples/crm-demo/**'
      - '.github/workflows/explore.yml'

concurrency:
  group: explore-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    defaults:
      run:
        working-directory: apps/escurel-explore

    steps:
      - uses: actions/checkout@v4

      # ghcr.io rejects uppercase repository paths. github.repository_owner
      # is "DataZooDE" here; emit a lowercased alias for image tags.
      - name: derive lowercase owner + short sha
        id: meta
        run: |
          {
            echo "owner_lc=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
            echo "sha_short=${GITHUB_SHA::7}"
          } >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.44.0'
          channel: stable
          cache: true

      # The shared kit is analyzed + tested in its own package first;
      # the app depends on it by path.
      - name: kit — flutter pub get
        working-directory: packages/escurel_explorer_kit
        run: flutter pub get

      - name: kit — flutter analyze
        working-directory: packages/escurel_explorer_kit
        run: flutter analyze

      - name: kit — flutter test
        working-directory: packages/escurel_explorer_kit
        run: flutter test --reporter expanded

      - name: flutter pub get
        run: flutter pub get

      - name: flutter analyze
        run: flutter analyze

      - name: flutter test
        run: flutter test --reporter expanded

      # The shipped bundle is built inside the Dockerfile (http mode). Keep
      # a CI smoke build so a broken web build fails fast before docker.
      - name: flutter build web (smoke)
        run: |
          flutter build web --release \
            --dart-define=ESCUREL_EXPLORE_MODE=http \
            --dart-define=ESCUREL_EXPLORE_VERSION=${GITHUB_SHA::7}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Context is the REPO ROOT so the Rust workspace sources are available
      # to the Dockerfile's BFF build stage; the Flutter bundle is built in
      # the Dockerfile's first stage (http mode, same-origin).
      - name: docker build + push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/escurel-explore/Dockerfile
          push: true
          build-args: |
            BUILD_VERSION=${{ steps.meta.outputs.sha_short }}
          tags: |
            ghcr.io/${{ steps.meta.outputs.owner_lc }}/escurel-explore:sha-${{ steps.meta.outputs.sha_short }}
            ghcr.io/${{ steps.meta.outputs.owner_lc }}/escurel-explore:latest
            ghcr.io/${{ steps.meta.outputs.owner_lc }}/escurel-explore:main
          # Scoped. Both this workflow and the other image build in this repo
          # used a bare `type=gha`, which is ONE shared scope — the Flutter SPA image
          # and the other were overwriting each other's layer cache, so
          # whichever ran last left the other cold. Distinct scopes give each
          # image its own.
          cache-from: type=gha,scope=escurel-explore
          cache-to: type=gha,mode=max,scope=escurel-explore

      - name: Summary
        run: |
          {
            echo "## escurel-explore deploy candidate"
            echo ""
            echo "Image: \`ghcr.io/${{ steps.meta.outputs.owner_lc }}/escurel-explore:sha-${{ steps.meta.outputs.sha_short }}\`"
            echo ""
            echo "Operator next step:"
            echo "\`\`\`"
            echo "/deploy-green dz-escurel-explore ${{ steps.meta.outputs.sha_short }}"
            echo "\`\`\`"
          } >> "$GITHUB_STEP_SUMMARY"