# Monthly restore drill (ADR 0015, issue #87): restores the latest backup
# set of the drilled stage into a scratch environment on the runner's Docker
# daemon (the stage host), verifies it, and logs the outcome as a comment on
# the pinned "Restore drills" issue. Since go-live (2026-07-12, #89) the
# drilled stage is Prod; the runner on ONE holds the dorfteich-prod_backups
# volume. TAG stays `test` on purpose: it only selects the drill-harness
# images (backup + api) that perform and verify the restore, and a forward
# schema restores a Prod set fine — it is not a claim about the Prod release.

name: Restore drill

on:
  schedule:
    # 04:17 UTC on the 1st — after the 03:00 stage-local nightly backups.
    - cron: '17 4 1 * *'
  # On demand: push a `drill-<anything>` tag (`git tag drill-$(date +%s) &&
  # git push origin --tags`). Gitea 1.22 cannot dispatch workflows via API
  # or UI (that arrives in 1.23 — then add workflow_dispatch here).
  push:
    tags: ['drill-*']

env:
  IMAGE_BASE: gitea.101010.cloud/stwaidele/dorfteich
  DRILL_SOURCE_VOLUME: dorfteich-prod_backups
  DRILL_LOG_ISSUE: '98'

jobs:
  drill:
    name: Restore the latest backup into a scratch stack
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Log in to the Gitea registry
        run: printf '%s' "${{ secrets.REGISTRY_TOKEN }}" | tr -d '[:space:]' | docker login gitea.101010.cloud -u fable-5 --password-stdin

      - name: Run the drill
        id: drill
        run: |
          set -o pipefail
          SOURCE_VOLUME=$DRILL_SOURCE_VOLUME IMAGE_BASE=$IMAGE_BASE TAG=test \
            sh deploy/backup/drill.sh 2>&1 | tee drill.log

      - name: Report the outcome on the drill log issue
        if: always()
        run: |
          OUTCOME="${{ steps.drill.outcome }}"
          {
            printf '**Restore drill %s** — source `%s`, run %s\n\n```\n' \
              "$OUTCOME" "$DRILL_SOURCE_VOLUME" "${{ github.run_number }}"
            tail -c 3000 drill.log 2>/dev/null || echo 'drill produced no log output'
            printf '```\n'
          } > comment.md
          # JSON-encode via a node container — the runner image guarantees
          # only git/curl/docker, not python or node.
          docker run --rm -i node:22.15-alpine node -e \
            'const fs=require("fs");process.stdout.write(JSON.stringify({body:fs.readFileSync(0,"utf8")}))' \
            < comment.md > comment.json
          curl -sf -X POST \
            -H "Authorization: token ${{ github.token }}" \
            -H 'Content-Type: application/json' \
            --data @comment.json \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/issues/$DRILL_LOG_ISSUE/comments" \
            > /dev/null && echo "reported to issue #$DRILL_LOG_ISSUE"