name: build-and-deploy-ghcr

on:
  push:
    branches:
      - main
      - high-performance
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  IMAGE_NAME: ghcr.io/traceworks2023/${{ github.event.repository.name }}
  K8S_NAMESPACE: nxtgauge
  DEPLOYMENT_NAME: nxtgauge-admin-solid
  CONTAINER_NAME: admin-solid
  APP_KEY: admin-solid
  GITOPS_REPO: Traceworks2023/nxtgauge-gitops

jobs:
  build-deploy:
    runs-on: [self-hosted, linux, x64, ubuntu-latest, docker-ready]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.DEPLOY_GITHUB_TOKEN }}

      - name: Build and push image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Sync GitOps release
        env:
          GITOPS_TOKEN: ${{ secrets.DEPLOY_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          image_ref="${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
          workdir="$(mktemp -d /tmp/nxtgauge-gitops.XXXXXX)"
          trap 'rm -rf "$workdir"' EXIT
          git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" "$workdir"
          cd "$workdir"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          for attempt in 1 2 3 4 5; do
            git fetch origin main
            git reset --hard origin/main
            ./scripts/set-app-release.sh "$APP_KEY" "$image_ref"
            if git diff --quiet; then
              echo "GitOps repo already up to date."
              exit 0
            fi
            git add apps scripts/set-app-release.sh
            git commit -m "chore(gitops): deploy ${APP_KEY}@${{ github.sha }}"
            if git push origin HEAD:main; then
              exit 0
            fi
            echo "GitOps push race on attempt ${attempt}, retrying..."
            git reset --hard origin/main
            sleep $((attempt * 2))
          done
          echo "Failed to update GitOps after multiple attempts."
          exit 1