name: Build and Deploy Platform
on:
  push:
    branches: [main]
    paths-ignore:
      - "**.md"
  workflow_dispatch:

# Serialize builds so parallel pushes don't race on the GitOps values update.
concurrency:
  group: build-deploy-platform
  cancel-in-progress: false

env:
  # PULL_REGISTRY: kubelet pulls via k3s mirror → harbor-core (matches registry-pull-secret)
  PULL_REGISTRY: registry.abrban.com
  # PUSH_REGISTRY: kaniko pushes directly to harbor-registry (internal, no TLS)
  PUSH_REGISTRY: harbor-registry.cloudhost.svc.cluster.local:5000
  PROJECT: abrban
  BUILD_NS: cloudhost-builds
  GITEA_HOST: gitea-http.gitea.svc.cluster.local:3000
  # PAT of the "ci" user, stored as repo secret CI_TOKEN (names starting with GITEA_ are reserved)
  GITEA_TOKEN: ${{ secrets.CI_TOKEN }}
  REPO_PATH: abrban/cloud-host.git
  GITOPS_REPO_PATH: abrban/cloud-host-gitops.git

jobs:
  build-and-deploy:
    runs-on: abrban-builder
    steps:
      - name: Checkout
        shell: sh
        run: |
          git clone --depth=1 --branch main "http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH}" workspace
          cd workspace
          echo "Checked out $(git rev-parse --short HEAD)"

      - name: Set image tag
        shell: sh
        run: |
          cd workspace
          SHA="$(git rev-parse --short HEAD)"
          TAG="$(date +%Y%m%d-%H%M)-${SHA}"
          echo "IMAGE_TAG=${TAG}" >> "$GITHUB_ENV"
          echo "Build tag: ${TAG}"

      - name: Build backend image (Kaniko Job)
        shell: sh
        run: |
          JOB_NAME="build-be-$(echo $IMAGE_TAG | tr '.:' '-' | cut -c1-50)"
          cat <<ENDJOB | kubectl apply -f -
          apiVersion: batch/v1
          kind: Job
          metadata:
            name: ${JOB_NAME}
            namespace: ${BUILD_NS}
          spec:
            ttlSecondsAfterFinished: 600
            backoffLimit: 0
            template:
              spec:
                restartPolicy: Never
                imagePullSecrets:
                  - name: registry-pull-secret
                initContainers:
                  - name: clone
                    # alpine/git ships git — no flaky apk install at build time
                    image: ${PULL_REGISTRY}/${PROJECT}/alpine-git:2.43.0
                    command:
                      - sh
                      - -c
                      - git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace
                    volumeMounts:
                      - name: ws
                        mountPath: /workspace
                containers:
                  - name: kaniko
                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
                    # Kaniko pulls base images (node:24-alpine) straight from
                    # docker.io — needs the egress proxy. NO_PROXY keeps the
                    # push to harbor-registry direct.
                    envFrom:
                      - secretRef:
                          name: registry-egress-proxy
                    args:
                      - --dockerfile=/workspace/backend/Dockerfile
                      - --context=dir:///workspace/backend
                      - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-backend:${IMAGE_TAG}
                      - --insecure
                      - --skip-tls-verify
                    volumeMounts:
                      - name: ws
                        mountPath: /workspace
                      - name: docker-config
                        mountPath: /kaniko/.docker
                volumes:
                  - name: ws
                    emptyDir: {}
                  - name: docker-config
                    secret:
                      secretName: kaniko-harbor-auth
                      items:
                        - key: .dockerconfigjson
                          path: config.json
          ENDJOB
          echo "Waiting for backend build job: ${JOB_NAME}"
          if ! kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=40m; then
            echo "--- kaniko logs (tail) ---"
            kubectl -n ${BUILD_NS} logs job/${JOB_NAME} -c kaniko --tail=100 || true
            exit 1
          fi
          echo "Backend build done"

      - name: Build frontend image (Kaniko Job)
        shell: sh
        run: |
          JOB_NAME="build-fe-$(echo $IMAGE_TAG | tr '.:' '-' | cut -c1-50)"
          cat <<ENDJOB | kubectl apply -f -
          apiVersion: batch/v1
          kind: Job
          metadata:
            name: ${JOB_NAME}
            namespace: ${BUILD_NS}
          spec:
            ttlSecondsAfterFinished: 600
            backoffLimit: 0
            template:
              spec:
                restartPolicy: Never
                imagePullSecrets:
                  - name: registry-pull-secret
                initContainers:
                  - name: clone
                    image: ${PULL_REGISTRY}/${PROJECT}/alpine-git:2.43.0
                    command:
                      - sh
                      - -c
                      - git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace
                    volumeMounts:
                      - name: ws
                        mountPath: /workspace
                containers:
                  - name: kaniko
                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
                    envFrom:
                      - secretRef:
                          name: registry-egress-proxy
                    args:
                      - --dockerfile=/workspace/frontend/Dockerfile
                      - --context=dir:///workspace/frontend
                      - --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com
                      - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-frontend:${IMAGE_TAG}
                      - --insecure
                      - --skip-tls-verify
                    volumeMounts:
                      - name: ws
                        mountPath: /workspace
                      - name: docker-config
                        mountPath: /kaniko/.docker
                volumes:
                  - name: ws
                    emptyDir: {}
                  - name: docker-config
                    secret:
                      secretName: kaniko-harbor-auth
                      items:
                        - key: .dockerconfigjson
                          path: config.json
          ENDJOB
          echo "Waiting for frontend build job: ${JOB_NAME}"
          if ! kubectl -n ${BUILD_NS} wait --for=condition=complete job/${JOB_NAME} --timeout=40m; then
            echo "--- kaniko logs (tail) ---"
            kubectl -n ${BUILD_NS} logs job/${JOB_NAME} -c kaniko --tail=100 || true
            exit 1
          fi
          echo "Frontend build done"

      - name: Update GitOps repo and push
        shell: sh
        run: |
          git clone --depth=1 --branch main "http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${GITOPS_REPO_PATH}" gitops-repo
          cd gitops-repo
          VALUES=platform/values-abrban.yaml
          if command -v yq >/dev/null 2>&1; then
            IMAGE_TAG="${IMAGE_TAG}" yq -i '.images.backend.tag = strenv(IMAGE_TAG) | .images.frontend.tag = strenv(IMAGE_TAG)' "${VALUES}"
          else
            # Only touch the tag line directly below each cloudhost-* repository line.
            sed -i "/repository: .*cloudhost-backend/{n;s|tag: \".*\"|tag: \"${IMAGE_TAG}\"|;}" "${VALUES}"
            sed -i "/repository: .*cloudhost-frontend/{n;s|tag: \".*\"|tag: \"${IMAGE_TAG}\"|;}" "${VALUES}"
          fi
          git config user.email "ci@abrban.com"
          git config user.name "Gitea Actions"
          git add "${VALUES}"
          if ! git diff --cached --quiet; then
            git commit -m "ci: deploy platform ${IMAGE_TAG}"
            git push origin HEAD:main
          fi