name: Build and deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

env:
  IMAGE_NAME: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/ghaymah-api

jobs:
  build-push:
    name: Build and push image
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push immutable and latest tags
        uses: docker/build-push-action@v7
        with:
          context: q1-deploy-monitor/app
          file: q1-deploy-monitor/app/Dockerfile
          push: true
          build-args: |
            RELEASE_SHA=${{ github.sha }}
          tags: |
            ${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.IMAGE_NAME }}:latest

  deploy-staging:
    name: Deploy and verify staging
    runs-on: ubuntu-latest
    needs: build-push
    env:
      DEPLOY_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/ghaymah-api:${{ github.sha }}
      GHAYMAH_APP_NAME: ${{ vars.GHAYMAH_STAGING_APP }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Show staging deployment target
        run: |
          echo "Image to deploy: ${DEPLOY_IMAGE}"
          echo "Staging service: ${GHAYMAH_APP_NAME:-ghaymah-api-staging}"

      - name: Install the documented Ghaymah CLI
        run: |
          # Ghaymah-specific command confirmed from https://ghaymah.systems/docs.
          curl -sSL https://cli.ghaymah.systems/install.sh | bash
          echo "$HOME/ghaymah/bin" >> "$GITHUB_PATH"
          "$HOME/ghaymah/bin/gy" version

      - name: Start immutable image in ephemeral staging
        shell: bash
        run: |
          docker run --detach \
            --name ghaymah-api-staging \
            --publish 18080:8080 \
            "${DEPLOY_IMAGE}"

      - name: Verify staging health and release
        shell: bash
        run: |
          trap 'docker rm --force ghaymah-api-staging >/dev/null 2>&1 || true' EXIT
          bash scripts/verify_deployment.sh \
            --app "${GHAYMAH_APP_NAME:-ghaymah-api-staging}" \
            --url "http://127.0.0.1:18080" \
            --expected-release "${{ github.sha }}"

  deploy-production:
    name: Verify production deployment
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment: production
    env:
      GHAYMAH_APP_NAME: ${{ vars.GHAYMAH_PRODUCTION_APP }}
      GHAYMAH_APP_URL: ${{ vars.GHAYMAH_PRODUCTION_URL }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Show production deployment target
        run: |
          echo "Approved image: ${{ env.IMAGE_NAME }}:${{ github.sha }}"
          echo "Ghaymah app: ${GHAYMAH_APP_NAME:-ghaymah-api}"
          echo "Ghaymah URL: ${GHAYMAH_APP_URL}"

      - name: Install the documented Ghaymah CLI
        run: |
          # Ghaymah-specific command confirmed from https://ghaymah.systems/docs.
          curl -sSL https://cli.ghaymah.systems/install.sh | bash
          echo "$HOME/ghaymah/bin" >> "$GITHUB_PATH"
          "$HOME/ghaymah/bin/gy" version

      - name: Verify approved production release
        shell: bash
        run: |
          bash scripts/verify_deployment.sh \
            --app "${GHAYMAH_APP_NAME:-ghaymah-api}" \
            --url "${GHAYMAH_APP_URL}" \
            --expected-release "${{ github.sha }}"