dev_deploy.yml

name: Deploy to Dev enviroment

on:
  push:
    branches: [main]
    paths:
      - 'services/**'
  workflow_dispatch:
    inputs:
      diff_range:
        description: 'Git diff range'
        required: false
        default: 'HEAD~1..HEAD'

jobs:
  detect:
    name: Detect Changed Services
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.detect.outputs.matrix }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - id: detect
        run: |
          SERVICES=()
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            DIFF_RANGE="${{ inputs.diff_range }}"
          else
            DIFF_RANGE="${{ github.event.before }}..${{ github.event.after }}"
          fi
          for svc in api_gateway post_service feed_service user_service follow_service; do
            if git diff --name-only $DIFF_RANGE | grep -q "^services/${svc}/"; then
              SERVICES+=("$svc")
            fi
          done
          MATRIX=$(printf '%s\n' "${SERVICES[@]}" | jq -R . | jq -sc .)
          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT

  build_push:
    needs: [detect]
    runs-on: ubuntu-latest
    if: needs.detect.outputs.matrix != '[""]'
    permissions:
      contents: write
    strategy:
      matrix:
        service: ${{ fromJson(needs.detect.outputs.matrix) }}
      max-parallel: 1
    steps:
      - uses: actions/checkout@v6
        with:
          ref: main
          sparse-checkout: |
            services/${{ matrix.service }}
            k8s/overlay/dev/${{ matrix.service }}_patch
            .github/actions/commit-manifest

      - name: Build
        run: |
          docker build -t alimx07/${{ matrix.service }}:${{ github.sha }} services/${{ matrix.service }}

      - name: Scan Image
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: alimx07/${{ matrix.service }}:${{ github.sha }}
          scan-type: 'image'
          scanners: 'vuln'
          severity: 'HIGH,CRITICAL,MEDIUM'
          exit-code: '1'
          format: 'table'
      
      - name : Login Docker
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Push Image
        run: |
          docker tag alimx07/${{ matrix.service }}:${{ github.sha }} alimx07/${{ matrix.service }}:dev
          docker push alimx07/${{ matrix.service }}:${{ github.sha }}
          docker push alimx07/${{ matrix.service }}:dev

      - uses: ./.github/actions/commit-manifest
        with:
          service: ${{ matrix.service }}
          sha: ${{ github.sha }}
          overlay: dev
          commit_message: "Service CI: update ${{ matrix.service }} image to ${{ github.sha }}"