# Prod deploy behind the manual gate (issue #89): after reviewing a
# published release vX.Y.Z, a human pushes `prod-vX.Y.Z-<suffix>` — that
# tag push IS the approval (Gitea 1.22 has no environment approvals; move
# to a real environment gate on 1.23+). The suffix keeps tags unique, so
# re-deploys and rollbacks are just new tags pointing at the same release:
#   git tag prod-v0.1.0-initial && git push origin prod-v0.1.0-initial
#   git tag prod-v0.1.0-rollback1 && git push origin prod-v0.1.0-rollback1

name: Prod deploy

on:
  push:
    tags: ['prod-v*']

env:
  IMAGE_BASE: gitea.101010.cloud/stwaidele/dorfteich
  DEPLOY_HOST: one.101010.cloud

jobs:
  deploy-prod:
    name: Deploy the released images to Prod
    runs-on: ubuntu-latest
    steps:
      - name: Resolve the release version from the tag
        run: |
          VERSION=$(echo "$GITHUB_REF_NAME" | grep -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+' | head -n1)
          [ -n "$VERSION" ] || { echo "tag $GITHUB_REF_NAME carries no vX.Y.Z version" >&2; exit 1; }
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          echo "deploying release $VERSION"

      - name: Verify the release images exist (never deploy unbuilt tags)
        run: |
          printf '%s' "${{ secrets.REGISTRY_TOKEN }}" | tr -d '[:space:]' | docker login gitea.101010.cloud -u fable-5 --password-stdin
          for app in web api collab backup; do
            docker buildx imagetools inspect $IMAGE_BASE-$app:$VERSION > /dev/null
          done

      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_TEST }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "${{ secrets.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts

      - name: Pin the version and restart the Prod stack
        run: |
          ssh deploy@$DEPLOY_HOST "cd /srv/DOCKER/dorfteich-prod \
            && sed -i 's/^TAG=.*/TAG=$VERSION/' .env \
            && docker compose pull --quiet && docker compose up -d --remove-orphans \
            && docker compose ps"

      - name: Wait for Prod readiness
        run: |
          for i in $(seq 1 45); do
            body=$(ssh deploy@$DEPLOY_HOST 'curl -s http://127.0.0.1:8121/api/v1/readyz' || true)
            case "$body" in
              *'"database","status":"ok"'*) echo "readyz: $body"; exit 0 ;;
            esac
            sleep 4
          done
          echo "Prod did not become ready" >&2; exit 1