# .github/workflows/deploy.yml
#
# CI/CD pipeline: build Docker image -> push to Ghaymah Container Registry
# -> deploy to staging automatically -> manual approval -> deploy to production.

name: Build and Deploy to Ghaymah

on:
  push:
    branches: [main]
  workflow_dispatch: {}

env:
  DOCKERHUB_USER: mohamedadel777
  IMAGE_NAME: ghaymah-exam-app

jobs:
  # ---------------------------------------------------------------------
  # 1) Build the image once and push it to Docker Hub, tagged with the
  #    commit SHA. Ghaymah pulls the image from Docker Hub when you
  #    deploy/redeploy from the dashboard (Deploy App -> Docker Hub).
  # ---------------------------------------------------------------------
  build-and-push:
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.tag }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set image tag (short commit SHA)
        id: meta
        run: echo "tag=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ env.DOCKERHUB_USER }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.tag }}
            ${{ env.DOCKERHUB_USER }}/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ---------------------------------------------------------------------
  # 2) Deploy to STAGING automatically — no approval needed.
  #    NOTE: Ghaymah's current dashboard doesn't expose a public
  #    redeploy-by-API step, so this job posts a reminder / calls a
  #    webhook if you set one up. If Ghaymah adds a CLI/API later,
  #    replace the "Trigger redeploy" step below with the real command.
  # ---------------------------------------------------------------------
  deploy-staging:
    needs: build-and-push
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://ghaymah-mithal-monitor-de4c1ce11f85.hosted.ghaymah.systems
    steps:
      - name: New image pushed — ready for staging redeploy
        run: |
          echo "New image pushed: ${{ env.DOCKERHUB_USER }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}"
          echo "Go to the Ghaymah dashboard -> your app -> Redeploy, and pick this tag from Docker Hub."
          # If/when Ghaymah exposes a redeploy webhook or CLI, call it here, e.g.:
          # curl -X POST "$GHAYMAH_REDEPLOY_WEBHOOK_URL"

      - name: Smoke test staging /health
        run: |
          sleep 10
          curl -f https://ghaymah-exam-app-06b532d0a81b.hosted.ghaymah.systems/health

  # ---------------------------------------------------------------------
  # 3) Deploy to PRODUCTION — gated behind a manual approval.
  #    The "environment: production" + protection rule configured in the
  #    repo settings (Settings -> Environments -> production -> Required
  #    reviewers) is what forces a human to click "Approve" in the
  #    Actions tab before this job runs.
  # ---------------------------------------------------------------------
  deploy-production:
    needs: [build-and-push, deploy-staging]
    runs-on: ubuntu-latest
    environment:
      name: production   # <-- manual approval gate lives here (repo settings)
      url: https://ghaymah-exam-app-06b532d0a81b.hosted.ghaymah.systems
    steps:
      - name: New image ready for production redeploy
        run: |
          echo "Approved. Image ready: ${{ env.DOCKERHUB_USER }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}"
          echo "Go to the Ghaymah dashboard -> your production app -> Redeploy, and pick this tag from Docker Hub."

      - name: Smoke test production /health
        run: |
          sleep 10
          curl -f https://ghaymah-exam-app-06b532d0a81b.hosted.ghaymah.systems/health