name: XControl Unified CI/CD Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: "Target environment"
        type: choice
        options: [dev, prod]
        default: dev

permissions:
  contents: read
  packages: write
  id-token: write

jobs:

  # -------------------------------------------------------------
  # CI — Code Quality → Build → Test → Security
  # -------------------------------------------------------------
  ci:
    name: "CI • ${{ matrix.service }} @ ${{ matrix.platform }}"
    runs-on: ubuntu-latest

    env:
      ENVIRONMENT: dev

    strategy:
      fail-fast: false
      matrix:
        platform: ["linux/amd64", "linux/arm64"]
        service: ["dashboard", "rag-server", "account"]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Code Quality
        uses: ./.github/actions/code-quality
        with:
          environment: ${{ env.ENVIRONMENT }}
          service: ${{ matrix.service }}
          platform: ${{ matrix.platform }}

      - name: Build
        uses: ./.github/actions/build
        with:
          environment: ${{ env.ENVIRONMENT }}
          service: ${{ matrix.service }}
          platform: ${{ matrix.platform }}

      - name: "Test • ${{ matrix.service }} @ ${{ matrix.platform }}"
        uses: ./.github/actions/test
        with:
          environment: ${{ env.ENVIRONMENT }}
          service: ${{ matrix.service }}
          platform: ${{ matrix.platform }}

      - name: Security Check
        uses: ./.github/actions/security
        with:
          environment: ${{ env.ENVIRONMENT }}
          service: ${{ matrix.service }}
          platform: ${{ matrix.platform }}

  build-base-images:
    name: Build Base Images
    needs: ci
    uses: ./.github/workflows/build-base-images.yml
    secrets: inherit
    with:
      registry: ghcr.io
      org: cloud-neutral-toolkit
      push_images: true

  build-service-images:
    name: Build Service Images
    needs: build-base-images
    uses: ./.github/workflows/build-service-images.yml
    secrets: inherit
    with:
      push_images: true

  # -------------------------------------------------------------
  # CD — Deploy（只在 workflow_dispatch 时跑）
  # -------------------------------------------------------------
  cd:
    name: "Deploy • ${{ matrix.service }} (${{ github.event.inputs.environment }})"
    runs-on: ubuntu-latest
    needs: build-service-images
    if: github.event_name == 'workflow_dispatch'

    strategy:
      fail-fast: false
      matrix:
        platform: ["linux/amd64"]
        service: ["dashboard", "rag-server", "account"]

    env:
      ENVIRONMENT: ${{ github.event.inputs.environment }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Deploy Services
        uses: ./.github/actions/deploy
        with:
          environment: ${{ env.ENVIRONMENT }}
          platform: ${{ matrix.platform }}
          service: ${{ matrix.service }}