docker.yml

name: build-and-push-image

on:
  push:
    branches: ["main"]

permissions:
  contents: read
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set image name (lowercase)
        shell: bash
        run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV

      - name: Write firebase-service-account.json into resources (for jar)
        shell: bash
        run: |
          set -euo pipefail

          # 1) 리소스 디렉토리 생성
          mkdir -p src/main/resources

          # 2) GitHub Secret(base64) -> json 파일 생성
          echo "${{ secrets.FIREBASE_SERVICE_ACCOUNT_JSON_B64 }}" | base64 -d > src/main/resources/firebase-service-account.json

          # 3) 권한 최소화 + 존재 확인(내용 출력 금지)
          chmod 600 src/main/resources/firebase-service-account.json
          ls -al src/main/resources/firebase-service-account.json

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.IMAGE }}:latest
            ${{ env.IMAGE }}:${{ github.sha }}