# Build backend/frontend images, push to Gitea Container Registry, deploy with pull-only compose.
#
# Repository Variables (Settings → Actions → Variables) — non-secret:
#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
#   REGISTRY_OWNER       Gitea user or org that owns the packages (same as image namespace)
#   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
#
# Repository Secrets (Settings → Actions → Secrets):
#   REGISTRY_USERNAME    Gitea username for docker login
#   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
#
# Optional:
#   STAGING_HTTP_PORT       host port for nginx (default 8088)
#
# Required for deploy job (absolute path on the runner host — forward slashes ok on Windows):
#   DEPLOY_SECRETS_DIR      folder containing database.staging.env + backend.staging.env
#
# Runner: self-hosted with Docker; Git Bash recommended on Windows (shell: bash).
#
# We do NOT use gitea.com/actions/checkout — many restricted networks cannot reach gitea.com.
# Checkout is a plain `git clone` from the same Gitea host (github.server_url / gitea alias).

name: Registry — build, push, deploy

on:
  push:
    branches: [main, master]
  workflow_dispatch:

defaults:
  run:
    shell: bash

jobs:
  build-and-push:
    runs-on: self-hosted
    outputs:
      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - name: Checkout (clone from this Gitea — no gitea.com)
        run: |
          set -e
          SERVER="${{ github.server_url }}"
          SERVER="${SERVER%/}"
          REPO="${{ github.repository }}"
          BRANCH="${{ github.ref_name }}"
          TOKEN="${{ github.token }}"
          ACTOR="${{ github.actor }}"
          HP="${SERVER#http://}"
          HP="${HP#https://}"
          if [[ "$SERVER" == https://* ]]; then
            CLONE_URL="https://${ACTOR}:${TOKEN}@${HP}/${REPO}.git"
          else
            CLONE_URL="http://${ACTOR}:${TOKEN}@${HP}/${REPO}.git"
          fi
          GIT_TERMINAL_PROMPT=0 git clone --depth 1 --branch "$BRANCH" "$CLONE_URL" .

      - name: Image tag and registry prefix
        id: meta
        run: |
          echo "image_tag=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
          echo "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}" >> "$GITHUB_ENV"

      - name: Log in to container registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ vars.REGISTRY_HOST }}" \
            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: Build and push backend
        run: |
          TAG="${{ steps.meta.outputs.image_tag }}"
          docker build \
            -t "${REGISTRY_PREFIX}/dyolink-backend:${TAG}" \
            -t "${REGISTRY_PREFIX}/dyolink-backend:latest" \
            ./backend
          docker push "${REGISTRY_PREFIX}/dyolink-backend:${TAG}"
          docker push "${REGISTRY_PREFIX}/dyolink-backend:latest"

      - name: Build and push frontend
        env:
          PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
        run: |
          TAG="${{ steps.meta.outputs.image_tag }}"
          docker build \
            --build-arg NEXT_PUBLIC_API_URL="${PUBLIC_BASE_URL}/api" \
            --build-arg NEXT_PUBLIC_APP_URL="${PUBLIC_BASE_URL}" \
            --build-arg NEXT_PUBLIC_APP_NAME="Dyolink" \
            -t "${REGISTRY_PREFIX}/dyolink-frontend:${TAG}" \
            -t "${REGISTRY_PREFIX}/dyolink-frontend:latest" \
            ./frontend
          docker push "${REGISTRY_PREFIX}/dyolink-frontend:${TAG}"
          docker push "${REGISTRY_PREFIX}/dyolink-frontend:latest"

  deploy:
    needs: build-and-push
    runs-on: self-hosted
    steps:
      - name: Checkout (shallow clone from this Gitea — no gitea.com)
        run: |
          set -e
          SERVER="${{ github.server_url }}"
          SERVER="${SERVER%/}"
          REPO="${{ github.repository }}"
          BRANCH="${{ github.ref_name }}"
          TOKEN="${{ github.token }}"
          ACTOR="${{ github.actor }}"
          HP="${SERVER#http://}"
          HP="${HP#https://}"
          if [[ "$SERVER" == https://* ]]; then
            CLONE_URL="https://${ACTOR}:${TOKEN}@${HP}/${REPO}.git"
          else
            CLONE_URL="http://${ACTOR}:${TOKEN}@${HP}/${REPO}.git"
          fi
          GIT_TERMINAL_PROMPT=0 git clone --depth 1 --branch "$BRANCH" "$CLONE_URL" .

      - name: Write deploy.registry.env and validate secrets path
        run: |
          SD='${{ vars.DEPLOY_SECRETS_DIR }}'
          if [ -z "$SD" ]; then
            echo "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
            echo "where database.staging.env and backend.staging.env live (not in git)."
            exit 1
          fi
          test -f "${SD}/database.staging.env" || { echo "Missing ${SD}/database.staging.env"; exit 1; }
          test -f "${SD}/backend.staging.env" || { echo "Missing ${SD}/backend.staging.env"; exit 1; }
          cd infrastructure
          STAGING_PORT='${{ vars.STAGING_HTTP_PORT }}'
          STAGING_PORT="${STAGING_PORT:-8088}"
          {
            echo "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
            echo "IMAGE_TAG=${{ needs.build-and-push.outputs.image_tag }}"
            echo "STAGING_HTTP_PORT=${STAGING_PORT}"
            echo "DEPLOY_SECRETS_DIR=${SD}"
          } > deploy.registry.env

      - name: Log in to container registry (for pull)
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ vars.REGISTRY_HOST }}" \
            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: Pull and start stack
        run: |
          set -e
          cd infrastructure
          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d