name: build-and-deploy-ghcr

on:
  push:
    branches:
      - main
      - high-performance
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
  K8S_NAMESPACE: nxtgauge-ai
  DEPLOYMENT_NAME: nxtgauge-ai-assistant
  CONTAINER_NAME: ai-assistant
  APP_KEY: ai-assistant
  GITOPS_REPO: Traceworks2023/nxtgauge-gitops

jobs:
  build-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.DEPLOY_GITHUB_TOKEN }}

      - name: Build and push image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64
          tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Configure kubeconfig
        run: |
          set -euo pipefail
          mkdir -p ~/.kube
          printf '%s' '${{ secrets.KUBE_CONFIG_DATA }}' | base64 -d > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Install kubectl
        uses: azure/setup-kubectl@v4

      - name: Deploy to Kubernetes
        env:
          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
          GHCR_TOKEN: ${{ secrets.DEPLOY_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          image_ref="${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
          kubectl -n "$K8S_NAMESPACE" create secret docker-registry ghcr-regcred --docker-server=ghcr.io --docker-username="$GHCR_USERNAME" --docker-password="$GHCR_TOKEN" --dry-run=client -o yaml | kubectl apply -f -
          kubectl -n "$K8S_NAMESPACE" patch deployment "$DEPLOYMENT_NAME" --type merge -p '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"ghcr-regcred"}]}}}}'
          kubectl -n "$K8S_NAMESPACE" set image deployment/"$DEPLOYMENT_NAME" "$CONTAINER_NAME"="$image_ref"
          kubectl -n "$K8S_NAMESPACE" rollout status deployment/"$DEPLOYMENT_NAME" --timeout=10m

      - name: Sync GitOps release
        env:
          GITOPS_TOKEN: ${{ secrets.DEPLOY_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          image_ref="${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
          git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
          cd /tmp/nxtgauge-gitops
          ./scripts/set-app-release.sh "$APP_KEY" "$image_ref"
          if git diff --quiet; then
            echo "GitOps repo already up to date."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add apps scripts/set-app-release.sh
          git commit -m "chore(gitops): deploy ${APP_KEY}@${{ github.sha }}"
          git push origin HEAD:main