spring-petclinic/.github/workflows/ci-petclinic-eks.yaml

name: CI - Petclinic EKS

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

# Queue (do not cancel) so EKS/GKE GitOps commits don't race each other
concurrency:
  group: gitops-main
  cancel-in-progress: false

env:
  AWS_REGION: ${{ vars.AWS_REGION || 'ap-northeast-2' }}
  ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY || 'eks/petclinic' }}
  YAML_PATH: k8s/aws/20-petclinic-Deployments-postgre.yaml

jobs:
  build-test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "25"
          cache: maven

      - name: Maven build & test
        run: |
          if [ -x "./mvnw" ]; then
            ./mvnw -B clean test package
          else
            mvn -B clean test package
          fi

  publish-and-gitops:
    needs: build-test
    runs-on: ubuntu-latest

    # Only publish/commit on main pushes (never on PRs)
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.actor != 'github-actions[bot]'

    permissions:
      id-token: write
      contents: write

    steps:
      - name: Checkout (with token for push)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "25"
          cache: maven

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2

      - name: Compute IMAGE_TAG / IMAGE_URI / APP_VERSION (AWS)
        run: |
          set -euo pipefail

          IMAGE_TAG="${GITHUB_SHA::7}"
          echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_ENV"

          BASE_VERSION=$(
            if [ -x "./mvnw" ]; then
              ./mvnw -q -Dexpression=project.version -DforceStdout help:evaluate
            else
              mvn -q -Dexpression=project.version -DforceStdout help:evaluate
            fi
          )
          BASE_VERSION="${BASE_VERSION%-SNAPSHOT}"
          echo "BASE_VERSION=${BASE_VERSION}" >> "$GITHUB_ENV"

          APP_VERSION="A-${BASE_VERSION}-${IMAGE_TAG}"
          echo "APP_VERSION=${APP_VERSION}" >> "$GITHUB_ENV"

          ECR_REGISTRY="${{ steps.ecr-login.outputs.registry }}"
          IMAGE_BASE="${ECR_REGISTRY}/${{ env.ECR_REPOSITORY }}"
          IMAGE_URI="${IMAGE_BASE}:${IMAGE_TAG}"
          echo "IMAGE_BASE=${IMAGE_BASE}" >> "$GITHUB_ENV"
          echo "IMAGE_URI=${IMAGE_URI}" >> "$GITHUB_ENV"

          echo "IMAGE_URI=${IMAGE_URI}"
          echo "APP_VERSION=${APP_VERSION}"

      - name: Build & Push image (ECR)
        env:
          DOCKER_BUILDKIT: 1
        run: |
          set -euo pipefail
          docker build -t "$IMAGE_URI" .
          docker push "$IMAGE_URI"

      - name: Tag & Push latest (ECR)
        run: |
          set -euo pipefail
          docker tag "${IMAGE_BASE}:${IMAGE_TAG}" "${IMAGE_BASE}:latest"
          docker push "${IMAGE_BASE}:latest"

      - name: Update EKS manifest (image + APP_VERSION)
        run: |
          set -euo pipefail
          test -f "$YAML_PATH" || { echo "Missing manifest: $YAML_PATH"; exit 1; }

          sudo snap install yq --channel=v4/stable

          yq -i '(.spec.template.spec.containers[] | select(.name == "petclinic-container") | .image) = strenv(IMAGE_URI)' "$YAML_PATH"

          yq -i '(.spec.template.spec.containers[] | select(.name == "petclinic-container") | .env[] | select(.name == "APP_VERSION").value) = strenv(APP_VERSION)' "$YAML_PATH"

          echo "Updated $YAML_PATH"
          yq '.spec.template.spec.containers[] | select(.name == "petclinic-container") | .image' "$YAML_PATH"
          yq '.spec.template.spec.containers[] | select(.name == "petclinic-container") | .env' "$YAML_PATH"

      - name: Commit & push GitOps change (EKS manifest only)
        run: |
          set -euo pipefail

          git config user.name  "github-actions"
          git config user.email "github-actions@github.com"

          git add "$YAML_PATH"

          if git diff --cached --quiet; then
            echo "No manifest changes to commit."
            exit 0
          fi

          git commit -m "chore(eks): deploy ${IMAGE_TAG} (APP_VERSION=${APP_VERSION}) [skip ci]"

          for i in 1 2 3 4 5; do
            echo "Push attempt ${i}..."
            git fetch origin main
            git rebase origin/main
            if git push origin HEAD:main; then
              echo "Push succeeded."
              exit 0
            fi
            echo "Push failed; retrying..."
            sleep 2
          done

          echo "Push failed after retries."
          exit 1