name: Build, test, publish, deploy

on:
  push:
  pull_request:
  workflow_dispatch:

env:
  GO_VERSION: "1.27.1"
  NODE_VERSION: "24"
  REGISTRY: nexus.urpi.be
  IMAGE_NAME: docker-hosted/go-bananas

jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: |
            web/package-lock.json
            sdk/package-lock.json
      - name: Build and test Go server
        run: |
          go vet ./...
          make test-go
          make build-go
      - name: Build and test admin UI
        run: |
          npm ci --no-audit --no-fund
          npm run lint
          npm test
          npm run build
        working-directory: web
      - name: Build and test SDK
        run: |
          npm ci --no-audit --no-fund
          npm run typecheck
          npm test
          npm run build
        working-directory: sdk
      - uses: azure/setup-helm@v4
        with:
          version: v3.18.6
      - name: Validate production chart
        run: helm lint --strict deploy/helm/go-bananas -f deploy/helm/go-bananas/values-prd.yaml

  publish:
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    needs: build-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.NEXUS_USERNAME }}
          password: ${{ secrets.NEXUS_PASSWORD }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

  deploy-prd:
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.18.6
      - uses: azure/setup-kubectl@v4
        with:
          version: v1.32.2
      - name: Bootstrap resources and deploy go-bananas
        env:
          KUBECONFIG_PRD: ${{ secrets.KUBECONFIG_PRD }}
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          GO_BANANAS_OIDC_CLIENT_SECRET: ${{ secrets.GO_BANANAS_OIDC_CLIENT_SECRET }}
        run: |
          set -Eeuo pipefail
          : "${GO_BANANAS_OIDC_CLIENT_SECRET:?Add Forgejo secret GO_BANANAS_OIDC_CLIENT_SECRET}"
          bash .forgejo/scripts/deploy-prd.sh deploy/helm/go-bananas go-bananas go-bananas "${{ github.sha }}" \
            --set-string identity.oidc.issuer=https://auth.urpi.be/realms/urpi \
            --set-string identity.oidc.clientId=go-bananas \
            --set-string identity.oidc.existingSecret=go-bananas-auth \
            --set identity.oidc.generateSecret=false