name: Deploy ATAuth to DO
# CI/CD: Gitea Actions → DigitalOcean managed k8s

on:
  push:
    branches: [main]
    paths-ignore:
      - '*.md'
      - 'docs/**'

env:
  REGISTRY: registry.digitalocean.com/ghostmesh-registry
  IMAGE_NAME: atauth
  DEPLOYMENT: atauth
  NAMESPACE: atauth

jobs:
  test:
    name: Test Gateway
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: gateway
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Type check
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Run tests
        run: npm run test:run

      - name: Notify test failure
        if: failure()
        run: |
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          FIRST_LINE=$(echo "${{ github.event.head_commit.message }}" | head -1)
          MSG=$(jq -n --arg body "🧪 ${{ github.repository }}: tests FAILED @ ${SHORT_SHA}
          └ ${FIRST_LINE}" '{msgtype: "m.text", body: $body}')
          curl -sf -X PUT \
            "${{ secrets.MATRIX_HOMESERVER_URL }}/_matrix/client/v3/rooms/${{ secrets.MATRIX_CICD_ROOM_ID }}/send/m.room.message/cicd-$(date +%s)-$$" \
            -H "Authorization: Bearer ${{ secrets.MATRIX_ACCESS_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "$MSG" || true

  build-and-deploy:
    name: Build, Push, Deploy
    runs-on: host
    needs: [test]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set short SHA
        id: sha
        run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> "$GITHUB_OUTPUT"

      - name: Notify build started
        env:
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          FIRST_LINE=$(echo "$COMMIT_MSG" | head -1)
          MSG=$(jq -n --arg body "🔨 ${{ github.repository }}: build started @ ${{ steps.sha.outputs.short }}
          ├ Commit: $FIRST_LINE
          └ Triggered by: ${{ github.actor }}" '{msgtype: "m.text", body: $body}')
          curl -sf -X PUT \
            "${{ secrets.MATRIX_HOMESERVER_URL }}/_matrix/client/v3/rooms/${{ secrets.MATRIX_CICD_ROOM_ID }}/send/m.room.message/cicd-$(date +%s)-$$" \
            -H "Authorization: Bearer ${{ secrets.MATRIX_ACCESS_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "$MSG" || true

      - name: Login to DO Container Registry
        run: echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "do-registry" --password-stdin

      - name: Build Docker image
        run: |
          docker build \
            --platform linux/amd64 \
            --build-arg BUILD_COMMIT=${{ steps.sha.outputs.short }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sha.outputs.short }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
            gateway/

      - name: Push Docker image
        run: |
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sha.outputs.short }}
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

      - name: Deploy to DO Kubernetes
        run: |
          TMPKUBE=$(mktemp)
          trap "rm -f $TMPKUBE" EXIT
          echo "${{ secrets.DO_KUBECONFIG }}" | base64 -d > "$TMPKUBE"
          chmod 600 "$TMPKUBE"
          KUBECONFIG="$TMPKUBE" kubectl set image deployment/${{ env.DEPLOYMENT }} \
            ${{ env.DEPLOYMENT }}=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sha.outputs.short }} \
            -n ${{ env.NAMESPACE }}
          KUBECONFIG="$TMPKUBE" kubectl rollout status deployment/${{ env.DEPLOYMENT }} -n ${{ env.NAMESPACE }} --timeout=120s

      - name: Notify build result
        if: always()
        env:
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          if [ "${{ job.status }}" = "success" ]; then
            EMOJI="✅"; STATUS="deployed"
          else
            EMOJI="❌"; STATUS="FAILED"
          fi
          FIRST_LINE=$(echo "$COMMIT_MSG" | head -1)
          MSG=$(jq -n --arg body "${EMOJI} ${{ github.repository }}: ${STATUS} @ ${{ steps.sha.outputs.short }}
          └ $FIRST_LINE" '{msgtype: "m.text", body: $body}')
          curl -sf -X PUT \
            "${{ secrets.MATRIX_HOMESERVER_URL }}/_matrix/client/v3/rooms/${{ secrets.MATRIX_CICD_ROOM_ID }}/send/m.room.message/cicd-$(date +%s)-$$" \
            -H "Authorization: Bearer ${{ secrets.MATRIX_ACCESS_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "$MSG" || true

      - name: Clean up Docker images
        if: always()
        run: |
          docker rmi ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sha.outputs.short }} 2>/dev/null || true
          docker rmi ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest 2>/dev/null || true