ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: write
  packages: write

env:
  # GHCR requires lowercase owner/image names.
  REGISTRY: ghcr.io

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # Lint-only install: do not pip install the project (would pull torch/HF).
      - name: Install Ruff
        run: pip install "ruff>=0.1"

      - name: Ruff check
        run: make lint

  test:
    name: Unit tests
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      # Slim install: unit tests must not need torch/transformers/streamlit.
      - name: Install test dependencies
        run: pip install "pytest>=7.0" "pydantic>=2.0" "pyyaml>=6.0" "numpy>=1.24"

      - name: Run unit tests
        run: make test

  # Phase 1C/2: build all product images; push to GHCR only on main.
  build-images:
    name: Build ${{ matrix.name }}
    runs-on: ubuntu-latest
    needs: lint
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: embedding-api
            dockerfile: docker/docker_embedding/Dockerfile.embedding-api
            image: proseqgo-embedding-api
            build_args: TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
          - name: go-prediction-api
            dockerfile: docker/docker_go_term/Dockerfile.api
            image: proseqgo-go-prediction-api
            build_args: TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
          - name: streamlit-ui
            dockerfile: docker/docker_streamlit/Dockerfile.streamlit
            image: proseqgo-streamlit-ui
            build_args: ""
          - name: trainer-api
            dockerfile: docker/docker_training/Dockerfile.training
            image: proseqgo-trainer-api
            build_args: TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
          - name: mlflow
            dockerfile: docker/docker_mlflow/Dockerfile
            image: proseqgo-mlflow
            build_args: ""
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc \
            /usr/local/share/powershell /usr/share/swift /usr/local/graalvm \
            /usr/local/.ghcup || true
          df -h

      - name: Set image name and push flag
        id: meta
        run: |
          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
          echo "image=${{ env.REGISTRY }}/${owner}/${{ matrix.image }}" >> "$GITHUB_OUTPUT"
          if [ '${{ github.event_name }}' = 'push' ] && [ '${{ github.ref }}' = 'refs/heads/main' ]; then
            echo "push=true" >> "$GITHUB_OUTPUT"
          else
            echo "push=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        if: steps.meta.outputs.push == 'true'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # PR / non-main: prove the image builds; do not push.
      - name: Build image (no push)
        if: steps.meta.outputs.push != 'true'
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: false
          outputs: type=cacheonly
          tags: ${{ steps.meta.outputs.image }}:sha-${{ github.sha }}
          build-args: ${{ matrix.build_args }}
          cache-from: type=gha,scope=build-${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=build-${{ matrix.name }}

      # main: publish immutable sha tag + moving main tag.
      - name: Build and push image
        if: steps.meta.outputs.push == 'true'
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          tags: |
            ${{ steps.meta.outputs.image }}:sha-${{ github.sha }}
            ${{ steps.meta.outputs.image }}:main
          build-args: ${{ matrix.build_args }}
          cache-from: type=gha,scope=build-${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=build-${{ matrix.name }}
          provenance: false