name: Build & Deploy API

# Workflow API (AdonisJS V7) — déployée en ClusterIP rubis-api dans le
# namespace rubis. Servie via le reverse proxy nginx de rubis-web.
on:
  push:
    branches: [main]
    paths:
      - 'apps/api/**'
      - 'packages/shared/**'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'package.json'
      - 'tsconfig.base.json'
      - 'turbo.json'
      - 'Dockerfile.api'
      - 'k3s/app/api.yml'
      - 'k3s/app/redis.yml'
      - '.gitea/workflows/deploy-api.yml'

env:
  REGISTRY: git.arthurbarre.fr
  IMAGE: ordinarthur/rubis-api
  NAMESPACE: rubis
  DEPLOYMENT: rubis-api
  CONTAINER: api

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Login to Gitea Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ordinarthur
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build and push API image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile.api
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:cache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:cache,mode=max

      - name: Install kubectl
        run: |
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x kubectl
          mv kubectl /usr/local/bin/

      - name: Deploy to K3s
        run: |
          mkdir -p ~/.kube
          echo "${{ secrets.KUBECONFIG }}" | base64 -d > ~/.kube/config
          chmod 600 ~/.kube/config

          kubectl apply -f k3s/namespace.yml

          kubectl -n $NAMESPACE create secret docker-registry gitea-registry \
            --docker-server=$REGISTRY \
            --docker-username=ordinarthur \
            --docker-password=${{ secrets.REGISTRY_PASSWORD }} \
            --dry-run=client -o yaml | kubectl apply -f -

          # Redis (idempotent — sert API workers BullMQ + cache)
          kubectl apply -f k3s/app/redis.yml
          kubectl apply -f k3s/app/api.yml

          # Pin l'image API + le init-container migrate (même image) sur le sha.
          kubectl -n $NAMESPACE set image deployment/$DEPLOYMENT \
            $CONTAINER=$REGISTRY/$IMAGE:${{ github.sha }}
          kubectl -n $NAMESPACE patch deployment $DEPLOYMENT \
            --type='json' \
            -p="[{\"op\":\"replace\",\"path\":\"/spec/template/spec/initContainers/0/image\",\"value\":\"$REGISTRY/$IMAGE:${{ github.sha }}\"}]"

          # APP_VERSION runtime — utilisé par Sentry comme nom de release pour
          # corréler les erreurs API avec un sha git précis (cf. start/sentry.ts).
          kubectl -n $NAMESPACE set env deployment/$DEPLOYMENT \
            APP_VERSION=${{ github.sha }}

          kubectl -n $NAMESPACE rollout status deployment/$DEPLOYMENT --timeout=300s