name: cd

on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]

jobs:
  deploy:
    name: Build and deploy
    runs-on: self-hosted
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' }}
    env:
      SERVICE: supervisor
      IMAGE: gitea.d-ma.be/mathias/supervisor
      INGESTION_IMAGE: gitea.d-ma.be/mathias/ingestion
      INFRA_REPO: git@gitea.d-ma.be:mathias/infra.git
      BUILDKIT_HOST: unix:///run/buildkit/buildkitd.sock
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build and push supervisor image
        run: |
          set -e
          trap 'rm -f /tmp/supervisor-image.tar' EXIT
          IMAGE_TAG="${{ github.sha }}"
          echo "Building ${IMAGE}:${IMAGE_TAG}"

          buildctl --addr "${BUILDKIT_HOST}" build \
            --frontend dockerfile.v0 \
            --local context=. \
            --local dockerfile=. \
            --opt build-arg:VERSION="${IMAGE_TAG}" \
            --output type=oci,dest=/tmp/supervisor-image.tar

          skopeo copy \
            oci-archive:/tmp/supervisor-image.tar \
            docker://${IMAGE}:${IMAGE_TAG} \
            --dest-creds "${{ secrets.REGISTRY_CREDS }}"

          echo "Built and pushed ${IMAGE}:${IMAGE_TAG}"

      - name: Build and push ingestion image
        run: |
          set -e
          trap 'rm -f /tmp/ingestion-image.tar' EXIT
          IMAGE_TAG="${{ github.sha }}"
          echo "Building ${INGESTION_IMAGE}:${IMAGE_TAG}"

          buildctl --addr "${BUILDKIT_HOST}" build \
            --frontend dockerfile.v0 \
            --local context=ingestion \
            --local dockerfile=ingestion \
            --output type=oci,dest=/tmp/ingestion-image.tar

          skopeo copy \
            oci-archive:/tmp/ingestion-image.tar \
            docker://${INGESTION_IMAGE}:${IMAGE_TAG} \
            --dest-creds "${{ secrets.REGISTRY_CREDS }}"

          echo "Built and pushed ${INGESTION_IMAGE}:${IMAGE_TAG}"

      - name: Update infra repo
        run: |
          set -e
          trap 'rm -rf /tmp/infra-update; rm -f ~/.ssh/infra_deploy_key' EXIT
          IMAGE_TAG="${{ github.sha }}"
          mkdir -p ~/.ssh
          echo "${{ secrets.INFRA_DEPLOY_KEY }}" > ~/.ssh/infra_deploy_key
          chmod 600 ~/.ssh/infra_deploy_key
          printf 'Host gitea.d-ma.be\n  HostName 127.0.0.1\n  Port 30022\n  StrictHostKeyChecking no\n' >> ~/.ssh/config

          GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
            git clone "${INFRA_REPO}" /tmp/infra-update

          cd /tmp/infra-update

          sed -i "s|gitea.d-ma.be/mathias/supervisor:.*|gitea.d-ma.be/mathias/supervisor:${IMAGE_TAG}|" \
            "k3s/apps/${SERVICE}/deployment.yaml"

          sed -i "s|gitea.d-ma.be/mathias/ingestion:.*|gitea.d-ma.be/mathias/ingestion:${IMAGE_TAG}|" \
            "k3s/apps/${SERVICE}/ingestion-deployment.yaml"

          git config user.email "cd-bot@d-ma.be"
          git config user.name "CD Bot"
          git add "k3s/apps/${SERVICE}/deployment.yaml" "k3s/apps/${SERVICE}/ingestion-deployment.yaml"
          git commit -m "chore(deploy): ${SERVICE}+ingestion → ${IMAGE_TAG}"
          GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
            git push

          echo "Infra repo updated: ${SERVICE}+ingestion → ${IMAGE_TAG}"