test-and-publish.yml

name: Test and Publish

on:
  push:
    branches: [ '*' ]
    tags: [ 'v*' ]  # Trigger on version tags like 'v0.1.2' or 'v1.2.3-rc.1'

jobs:
  test-app:
    name: Test App
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run tests
        run: docker compose -f docker-compose.test.yml run test ./run-tests.sh

  lint:
    name: Lint and Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-go@v5
      with:
        go-version: '1.23'
        check-latest: true
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v6
      with:
        version: latest
    - name: govulncheck
      run: |
        go install golang.org/x/vuln/cmd/govulncheck@latest
        govulncheck ./...

  build-and-publish:
    name: Build and Publish
    needs: [ 'test-app', 'lint' ]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ vars.DOCKER_ORG }}/auth-proxy
            ghcr.io/${{ github.repository_owner }}/auth-proxy
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major.minor}}

      - name: Build and push Docker image to GHCR and Docker Hub
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}