# Build backend/frontend images, push to Gitea Container Registry, deploy with pull-only compose.
#
# Repository Variables (Settings → Actions → Variables) — non-secret:
#   REGISTRY_HOST        e.g. 178.131.50.201:3000   (no http/https)
#   REGISTRY_OWNER       Gitea user or org that owns the packages (same as image namespace)
#   PUBLIC_BASE_URL      URL users open in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
#
# Repository Secrets (Settings → Actions → Secrets):
#   REGISTRY_USERNAME    Gitea username for docker login
#   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
#
# HTTP registry (typical self-hosted Gitea): Docker defaults to HTTPS. If login/push fails with
#   "server gave HTTP response to HTTPS client", add REGISTRY_HOST (e.g. 192.168.1.100:3000) to the
#   Docker daemon "insecure-registries" on the RUNNER machine, then restart Docker (Docker Desktop
#   → Settings → Docker Engine → JSON → "insecure-registries": ["host:port"]).
#
# Optional:
#   STAGING_HTTP_PORT       host port for nginx (default 8088)
#
# Required for deploy job (absolute path on the runner host):
#   DEPLOY_SECRETS_DIR      folder containing database.staging.env + backend.staging.env
#
# Runner: self-hosted with Docker. Default shell is powershell (Windows act_runner often has no WSL bash).
# For a Linux runner, change defaults.run.shell to bash and restore bash syntax if needed.
#
# We do NOT use gitea.com/actions/checkout — many restricted networks cannot reach gitea.com.
# Checkout is a plain git clone from the same Gitea host.

name: Registry — build, push, deploy

on:
  push:
    branches: [main, master]
  workflow_dispatch:

defaults:
  run:
    shell: powershell

jobs:
  temp-success:
    runs-on: self-hosted
    steps:
      - name: Temporary placeholder (always success)
        run: |
          $ErrorActionPreference = 'Stop'
          Write-Host "Temporary workflow is active."
          Write-Host "Trigger: ${{ github.event_name }}"
          Write-Host "Branch:  ${{ github.ref_name }}"
          Write-Host "Commit:  ${{ github.sha }}"
          Write-Host "Production build/push/deploy steps are intentionally commented."
          exit 0

  # ---------------------------------------------------------------------------
  # Production pipeline is temporarily disabled.
  # Uncomment these jobs after split-DNS / registry reachability is fixed.
  # ---------------------------------------------------------------------------
  #
  # build-and-push:
  #   runs-on: self-hosted
  #   outputs:
  #     image_tag: ${{ steps.meta.outputs.image_tag }}
  #   steps:
  #     - name: Checkout (clone from this Gitea — no gitea.com)
  #     - name: Image tag and registry prefix
  #     - name: Log in to container registry
  #     - name: Build and push backend
  #     - name: Build and push frontend
  #
  # deploy:
  #   needs: build-and-push
  #   runs-on: self-hosted
  #   steps:
  #     - name: Checkout (shallow clone from this Gitea — no gitea.com)
  #     - name: Write deploy.registry.env and validate secrets path
  #     - name: Log in to container registry (for pull)
  #     - name: Pull and start stack



  ####SAMPLE
  # name: Registry — build, push, deploy

  # on:
  #   push:
  #     branches: [main, master]
  #   workflow_dispatch:

  # defaults:
  #   run:
  #     shell: powershell

  # jobs:
  #   build-and-push:
  #     runs-on: self-hosted
  #     outputs:
  #       image_tag: ${{ steps.meta.outputs.image_tag }}
  #     steps:
  #       - name: Checkout (clone from this Gitea — no gitea.com)
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $Server = "${{ github.server_url }}".TrimEnd('/')
  #           $Repo = "${{ github.repository }}"
  #           $Branch = "${{ github.ref_name }}"
  #           $Token = "${{ github.token }}"
  #           $Actor = "${{ github.actor }}"
  #           $hp = $Server -replace '^https?://', ''
  #           if ($Server.StartsWith('https')) {
  #             $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
  #           } else {
  #             $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
  #           }
  #           $env:GIT_TERMINAL_PROMPT = '0'
  #           git clone --depth 1 --branch $Branch $cloneUrl .

  #       - name: Image tag and registry prefix
  #         id: meta
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $short = (git rev-parse --short HEAD).Trim()
  #           $utf8 = New-Object System.Text.UTF8Encoding $false
  #           [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
  #           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
  #           [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)

  #       - name: Log in to container registry
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $pass = @'
  #           ${{ secrets.REGISTRY_PASSWORD }}
  #           '@
  #           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

  #       - name: Build and push backend
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $tag = "${{ steps.meta.outputs.image_tag }}"
  #           docker build `
  #             -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
  #             -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
  #             ./backend
  #           docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
  #           docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"

  #       - name: Build and push frontend
  #         env:
  #           PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $tag = "${{ steps.meta.outputs.image_tag }}"
  #           $base = $env:PUBLIC_BASE_URL
  #           docker build `
  #             --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
  #             --build-arg "NEXT_PUBLIC_APP_URL=$base" `
  #             --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
  #             -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
  #             -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
  #             ./frontend
  #           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
  #           docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"

  #   deploy:
  #     needs: build-and-push
  #     runs-on: self-hosted
  #     steps:
  #       - name: Checkout (shallow clone from this Gitea — no gitea.com)
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $Server = "${{ github.server_url }}".TrimEnd('/')
  #           $Repo = "${{ github.repository }}"
  #           $Branch = "${{ github.ref_name }}"
  #           $Token = "${{ github.token }}"
  #           $Actor = "${{ github.actor }}"
  #           $hp = $Server -replace '^https?://', ''
  #           if ($Server.StartsWith('https')) {
  #             $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
  #           } else {
  #             $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
  #           }
  #           $env:GIT_TERMINAL_PROMPT = '0'
  #           git clone --depth 1 --branch $Branch $cloneUrl .

  #       - name: Write deploy.registry.env and validate secrets path
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
  #           if ([string]::IsNullOrWhiteSpace($SD)) {
  #             Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
  #             Write-Host "where database.staging.env and backend.staging.env live (not in git)."
  #             exit 1
  #           }
  #           if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
  #             Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
  #             exit 1
  #           }
  #           if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
  #             Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
  #             exit 1
  #           }
  #           $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
  #           if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '8088' }
  #           $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
  #           $lines = @(
  #             "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
  #             "IMAGE_TAG=$imageTag",
  #             "STAGING_HTTP_PORT=$stagingPort",
  #             "DEPLOY_SECRETS_DIR=$SD"
  #           )
  #           Set-Location infrastructure
  #           $lines | Set-Content -Path deploy.registry.env -Encoding utf8

  #       - name: Log in to container registry (for pull)
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           $pass = @'
  #           ${{ secrets.REGISTRY_PASSWORD }}
  #           '@
  #           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

  #       - name: Pull and start stack
  #         run: |
  #           $ErrorActionPreference = 'Stop'
  #           Set-Location infrastructure
  #           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
  #           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d