# ── Etapa 1: instalar só dependências de produção ──
FROM node:22-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

# ── Etapa 2: imagem final enxuta ──────────────────
FROM node:22-alpine
WORKDIR /app

# Copia apenas o resultado da etapa anterior
COPY --from=deps /app/node_modules ./node_modules
COPY src ./src
COPY package.json ./

ENV NODE_ENV=production
EXPOSE 3000
CMD ["node", "src/app.js"]

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB:       tasksdb
      POSTGRES_USER:     postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      retries: 5

  api:
    build:
      context: ./backend
      dockerfile: Dockerfile.dev
    environment:
      DB_HOST: db   # nome do serviço = hostname na rede
      DB_NAME: tasksdb
    ports:
      - "3000:3000"
    depends_on:
      db:
        condition: service_healthy

  frontend:
    build: ./frontend
    ports:
      - "8080:80"
    depends_on:
      - api

volumes:
  pg_data:

jobs:
  test:                          # tier 1 — paralelo
    runs-on: ubuntu-latest
    # ...

  security:                      # tier 1 — paralelo
    runs-on: ubuntu-latest
    # ...

  build:                         # tier 2 — espera os dois
    needs: [test, security]
    runs-on: ubuntu-latest
    # ...

  push:                          # tier 3
    needs: build
    if: github.event_name == 'push'
    # ...

  deploy:                        # tier 4
    needs: push
    if: github.event_name == 'push'
    environment: production      # aparece no GitHub
    # ...

  healthcheck:                   # tier 5
    needs: deploy
    if: github.event_name == 'push'
    # ...

  deploy:
    needs: build          # só roda se CI passou
    runs-on: ubuntu-latest

    steps:
      - name: Configurar credenciais AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id:     ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: sa-east-1

      - name: Deploy via SSH na EC2
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ubuntu
          key:  ${{ secrets.EC2_SSH_KEY }}
          script: |
            aws ecr get-login-password --region sa-east-1 \
              | docker login --username AWS --password-stdin $ECR_URL

            docker pull $ECR_URL/app:latest

            docker stop app || true
            docker rm   app || true

            docker run -d --name app \
              --env-file /etc/app/.env \
              -p 80:3000 \
              --restart unless-stopped \
              $ECR_URL/app:latest

            docker image prune -f