# ==============================================================================
# Ghaymah Cloud CI/CD Pipeline Workflow — Question 3
# Candidate: Marwan Abdelmoneim (marwanabdelmoneim / marwantamermo@gmail.com)
# ==============================================================================

name: Ghaymah Cloud CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      deploy_target:
        description: 'Target Deployment Environment'
        required: true
        default: 'staging'
        type: choice
        options: [staging, production]

env:
  REGISTRY_HOST: registry.ghaymah.systems
  IMAGE_NAME: ghaymah-app/api-service
  GHAYMAH_CLUSTER_ID: ghaymah-prod-cluster-01

jobs:
  # ----------------------------------------------------------------------------
  # Stage 1: Build & Security Vulnerability Scanning
  # ----------------------------------------------------------------------------
  build-and-scan:
    name: 🐳 Build & Scan Docker Image
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.vars.outputs.tag }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Calculate Image Tag
        id: vars
        run: echo "tag=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Log in to Ghaymah Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_HOST }}
          username: ${{ secrets.GHAYMAH_REGISTRY_USER }}
          password: ${{ secrets.GHAYMAH_REGISTRY_TOKEN }}

      - name: Build & Push Docker Image
        uses: docker/build-push-action@v5
        with:
          context: ./q1-deploy-monitor
          file: ./q1-deploy-monitor/Dockerfile
          push: true
          tags: |
            ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.tag }}
            ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:latest

      - name: Security Vulnerability Scan (Trivy)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.tag }}
          severity: 'CRITICAL,HIGH'

  # ----------------------------------------------------------------------------
  # Stage 2: Staging Deployment (Automated)
  # ----------------------------------------------------------------------------
  deploy-staging:
    name: 🚀 Automated Deploy to Staging
    needs: build-and-scan
    if: github.ref == 'refs/heads/develop' || github.event.inputs.deploy_target == 'staging'
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.ghaymah.systems
    steps:
      - name: Install Ghaymah CLI
        run: curl -fsSL https://cli.ghaymah.systems/install.sh | bash

      - name: Deploy to Staging Cluster via Ghaymah CLI
        run: |
          ghaymah auth login --token "${{ secrets.GHAYMAH_STAGING_TOKEN }}"
          ghaymah context set staging-cluster
          ghaymah deployment set-image deployment/api-service \
            app=${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-scan.outputs.image_tag }} \
            --namespace=staging

  # ----------------------------------------------------------------------------
  # Stage 3: Production Deployment (Manual Approval Gate Required)
  # ----------------------------------------------------------------------------
  deploy-production:
    name: 🛡️ Manual Approval Gate & Production Deployment
    needs: build-and-scan
    if: github.ref == 'refs/heads/main' || github.event.inputs.deploy_target == 'production'
    runs-on: ubuntu-latest
    # Requires reviewer approval configured under GitHub Repo -> Settings -> Environments -> production
    environment:
      name: production
      url: https://api.ghaymah.systems
    steps:
      - name: Install Ghaymah CLI
        run: curl -fsSL https://cli.ghaymah.systems/install.sh | bash

      - name: Canary Deployment & Health Verification via Ghaymah CLI
        run: |
          ghaymah auth login --token "${{ secrets.GHAYMAH_PROD_TOKEN }}"
          ghaymah context set production-cluster
          ghaymah deployment canary-start deployment/api-service \
            --image=${{ env.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-scan.outputs.image_tag }} \
            --weight=10
          sleep 60
          ghaymah deployment canary-promote deployment/api-service --namespace=production

# ==============================================================================
# DOCUMENTATION: Staging vs. Production & Ghaymah CLI Integration
# ==============================================================================
# 1. Staging vs Production Differences:
#    - Staging (staging.ghaymah.systems): Shared cluster namespace, anonymized DB data, automated deploy on `develop`.
#    - Production (api.ghaymah.systems): Dedicated VPC, Multi-AZ cluster (39 pods), primary/replica DB, manual approval gate.
#
# 2. Ghaymah CLI Integration:
#    - Auth: `ghaymah auth login --token <TOKEN>`
#    - Registry: `ghaymah registry login`
#    - Deploy: `ghaymah deployment set-image deployment/<NAME> app=<IMAGE>`
# ==============================================================================