name: Ghaymah CI/CD Pipeline

on:
  push:
    branches: [ main, staging ]
  pull_request:
    branches: [ main ]

jobs:
  # Stage 1: Build & Push Docker Image to Ghaymah Container Registry
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Log in to Ghaymah Container Registry
        run: |
          echo "${{ secrets.GHAYMAH_REGISTRY_TOKEN }}" | docker login registry.ghaymah.systems -u "${{ secrets.GHAYMAH_REGISTRY_USER }}" --password-stdin

      - name: Build Docker Image
        run: |
          docker build -t registry.ghaymah.systems/admin/q1-deploy-monitor:${{ github.sha }} .
          docker tag registry.ghaymah.systems/admin/q1-deploy-monitor:${{ github.sha }} registry.ghaymah.systems/admin/q1-deploy-monitor:latest

      - name: Push Image to Ghaymah Registry
        run: |
          docker push registry.ghaymah.systems/admin/q1-deploy-monitor:${{ github.sha }}
          docker push registry.ghaymah.systems/admin/q1-deploy-monitor:latest

  # Stage 2: Deploy to Staging Environment
  deploy-staging:
    needs: build-and-push
    if: github.ref == 'refs/heads/staging'
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Deploy to Ghaymah Staging
        run: |
          echo "Deploying image registry.ghaymah.systems/admin/q1-deploy-monitor:${{ github.sha }} to Staging..."

  # Stage 3: Deploy to Production Environment (Requires Manual Approval via GitHub Environment)
  deploy-production:
    needs: build-and-push
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production  # Requires explicit manual reviewer approval configured in GitHub repository settings
    steps:
      - name: Deploy to Ghaymah Production
        run: |
          echo "Deploying image registry.ghaymah.systems/admin/q1-deploy-monitor:${{ github.sha }} to Production..."