name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build-and-deploy:
    runs-on: toolctrl-ci
    steps:
      - name: Setup hosts override and Docker CLI
        run: |
          echo "192.168.178.62 git.tool-ctrl.de" >> /etc/hosts
          apt-get update -qq
          apt-get install -qq -y --no-install-recommends ca-certificates curl git
          install -m 0755 -d /etc/apt/keyrings
          curl -fsSL https://download.docker.com/linux/debian/gpg | tee /etc/apt/keyrings/docker.asc >/dev/null
          chmod a+r /etc/apt/keyrings/docker.asc
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list >/dev/null
          apt-get update -qq
          apt-get install -qq -y --no-install-recommends docker-ce-cli docker-buildx-plugin
          docker --version
          docker buildx version

      - name: Checkout
        run: |
          mkdir -p /workspace/repo
          cd /workspace/repo
          git clone "https://${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PAT }}@git.tool-ctrl.de/${{ github.repository }}.git" .
          git checkout "${{ github.sha }}"

      - name: Static checks
        run: |
          cd /workspace/repo
          npm run check
          npm test
          git diff --check

      - name: Login to Gitea Registry
        run: echo "${{ secrets.REGISTRY_PAT }}" | docker login git.tool-ctrl.de --username "${{ secrets.REGISTRY_USER }}" --password-stdin

      - name: Build and push image
        env:
          IMAGE: git.tool-ctrl.de/${{ github.repository }}
          SHA: ${{ github.sha }}
        run: |
          cd /workspace/repo
          IMAGE_LC=$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]')
          docker build \
            --build-arg APP_REVISION="$SHA" \
            -t "$IMAGE_LC:$SHA" \
            -t "$IMAGE_LC:main" \
            .
          docker push "$IMAGE_LC:$SHA"
          docker push "$IMAGE_LC:main"

      - name: Trigger Coolify deploy
        env:
          COOLIFY_RESOURCE_UUID: ocwtt7rd2zijtlszgua005k9
        run: |
          curl -fsS -X POST \
            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}" \
            "https://saas-ctrl.com/api/v1/deploy?uuid=${COOLIFY_RESOURCE_UUID}&force=true"

      - name: Verify deployed revision and readiness
        env:
          EXPECTED_REVISION: ${{ github.sha }}
          READY_URL: https://tool-ctrl.de/readyz
        run: |
          for attempt in $(seq 1 36); do
            READY_RESPONSE=$(curl -fsS --max-time 10 "$READY_URL" 2>/dev/null || true)
            DEPLOYED_REVISION=$(printf '%s' "$READY_RESPONSE" | node -e '
              let body = "";
              process.stdin.on("data", (chunk) => { body += chunk; });
              process.stdin.on("end", () => {
                try {
                  const parsed = JSON.parse(body);
                  if (parsed.ok === true && typeof parsed.revision === "string") {
                    process.stdout.write(parsed.revision);
                  }
                } catch (_error) {}
              });
            ' 2>/dev/null || true)

            if [ "$DEPLOYED_REVISION" = "$EXPECTED_REVISION" ]; then
              echo "toolctrl-website is ready on revision $EXPECTED_REVISION"
              exit 0
            fi

            echo "Waiting for revision $EXPECTED_REVISION (attempt $attempt/36)"
            sleep 10
          done

          echo "Timed out waiting for ready revision $EXPECTED_REVISION" >&2
          exit 1