docker.yml

# =============================================================================
# Docker Build, Test, and Publish
# =============================================================================
# Builds the CPU Docker image, runs the full test suite inside it,
# and publishes to GHCR on pushes to main/dev (i.e., after PR merge).
# =============================================================================

name: Docker Build, Test, and Publish

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [dev, main]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - 'LICENSE'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions:
  contents: read
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: mcdc-project/mcdc

jobs:

  # ---------------------------------------------------------------------------
  # Stage 0: Detect what changed (drives downstream job decisions)
  # ---------------------------------------------------------------------------
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      docker_relevant: ${{ steps.filter.outputs.docker_relevant }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            docker_relevant:
              - 'containers/**'
              - 'Dockerfile*'
              - 'pyproject.toml'
              - 'requirements*.txt'
              - '.dockerignore'
              - '.github/workflows/docker.yml'

  # ---------------------------------------------------------------------------
  # Stage 1: Build — runs on EVERY PR (cheap sanity check)
  # ---------------------------------------------------------------------------
  build:
    name: Build Docker image
    needs: changes
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.determine-tag.outputs.tag }}
    steps:
      - uses: actions/checkout@v4

      - name: Determine image tag
        id: determine-tag
        run: |
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo "tag=${{ github.base_ref }}" >> $GITHUB_OUTPUT
          else
            echo "tag=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          fi
          
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: containers/Dockerfile
          tags: mcdc:${{ steps.determine-tag.outputs.tag }}
          cache-from: type=gha
          cache-to: type=gha,mode=max,ignore-error=true
          outputs: type=docker,dest=/tmp/mcdc-image.tar

      - name: Upload image artifact
        uses: actions/upload-artifact@v4
        with:
          name: mcdc-image
          path: /tmp/mcdc-image.tar
          retention-days: 1

  # ---------------------------------------------------------------------------
  # Stage 2a: Unit tests — runs on EVERY PR (cheap, ~5 min)
  # ---------------------------------------------------------------------------
  unit-test:
    name: Unit tests (Docker)
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download image artifact
        uses: actions/download-artifact@v4
        with:
          name: mcdc-image
          path: /tmp

      - name: Load Docker image
        run: docker load -i /tmp/mcdc-image.tar

      - name: Verify MC/DC import
        run: |
          docker run --rm mcdc:${{ needs.build.outputs.image_tag }} \
            python -c "import mcdc; print('MC/DC import OK')"

      - name: Smoke test image contents (no mount)
        run: |
          docker run --rm \
            -w /opt/mcdc/test/unit \
            mcdc:${{ needs.build.outputs.image_tag }} python -m pytest -v .

      - name: Run unit tests (with workspace mount)
        run: |
          docker run --rm \
            -v ${{ github.workspace }}:/opt/mcdc \
            -w /opt/mcdc/test/unit \
            mcdc:${{ needs.build.outputs.image_tag }} python -m pytest -v .

  # ---------------------------------------------------------------------------
  # Stage 2b: Regression — only on push, or on PRs touching docker-relevant files
  # ---------------------------------------------------------------------------
  regression-test:
    name: Regression – ${{ matrix.mode }}
    needs: [changes, build]
    if: |
      github.event_name == 'push' ||
      needs.changes.outputs.docker_relevant == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: ${{ matrix.timeout }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - mode: Python-Serial
            run_cmd: "python -m pytest -v test/regression"
            timeout: 10
          - mode: Python-MPI
            run_cmd: |
              python -m pytest -v test/regression --mpiexec=2
            timeout: 20
          - mode: Numba-Serial
            run_cmd: "python -m pytest -v test/regression --mode numba"
            timeout: 120
          - mode: Numba-MPI
            run_cmd: |
              python -m pytest -v test/regression --mode numba --mpiexec=2
            timeout: 120

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Checkout regression test data
        uses: actions/checkout@v4
        with:
          repository: mcdc-project/mcdc-regression_test_data
          path: test/regression/mcdc-regression_test_data
          fetch-depth: 1

      - name: Download image artifact
        uses: actions/download-artifact@v4
        with:
          name: mcdc-image
          path: /tmp

      - name: Load Docker image
        run: docker load -i /tmp/mcdc-image.tar

      - name: Run regression tests (${{ matrix.mode }})
        run: |
          docker run --rm \
            -v ${{ github.workspace }}:/opt/mcdc \
            -w /opt/mcdc \
            mcdc:${{ needs.build.outputs.image_tag }} bash -lc '
              git config --global --add safe.directory /opt/mcdc
              git config --global --add safe.directory /opt/mcdc/test/regression/mcdc-regression_test_data
              ${{ matrix.run_cmd }}
            '

  # ---------------------------------------------------------------------------
  # Stage 3: Publish — only on push to dev/main, after all tests pass
  # ---------------------------------------------------------------------------
  publish:
    name: Publish to GHCR
    needs: [build, unit-test, regression-test]
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Download image artifact
        uses: actions/download-artifact@v4
        with:
          name: mcdc-image
          path: /tmp

      - name: Load Docker image
        run: docker load -i /tmp/mcdc-image.tar

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push to registry
        run: |
          BRANCH=${{ needs.build.outputs.image_tag }}
          DATE=$(date +%Y-%m-%d)
          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          FULL_IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

          # Tag with branch name (dev or main)
          docker tag mcdc:${BRANCH} ${FULL_IMAGE}:${BRANCH}
          docker push ${FULL_IMAGE}:${BRANCH}

          # Tag with branch, date and short commit SHA for traceability
          docker tag mcdc:${BRANCH} ${FULL_IMAGE}:${BRANCH}-${DATE}-${SHA}
          docker push ${FULL_IMAGE}:${BRANCH}-${DATE}-${SHA}

          # If pushing to main, also update the 'latest' tag
          if [ "${BRANCH}" == "main" ]; then
            docker tag mcdc:${BRANCH} ${FULL_IMAGE}:latest
            docker push ${FULL_IMAGE}:latest
          fi