name: Build and deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

env:
  IMAGE_NAME: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/ghaymah-api

jobs:
  build-push:
    name: Build and push image
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push immutable and latest tags
        uses: docker/build-push-action@v6
        with:
          context: q1-deploy-monitor/app
          file: q1-deploy-monitor/app/Dockerfile
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.IMAGE_NAME }}:latest

  deploy-staging:
    name: Deploy to staging
    runs-on: ubuntu-latest
    needs: build-push
    env:
      DEPLOY_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/ghaymah-api:${{ github.sha }}
      GHAYMAH_APP_NAME: ${{ vars.GHAYMAH_STAGING_APP }}
      GHAYMAH_API_TOKEN: ${{ secrets.GHAYMAH_API_TOKEN }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Show staging deployment target
        run: |
          echo "Image to deploy: ${DEPLOY_IMAGE}"
          echo "Ghaymah app: ${GHAYMAH_APP_NAME:-myapp-staging}"

      - name: Install the documented Ghaymah CLI
        run: |
          # Official installer per https://ghaymah.systems/docs; confirmed by direct
          # execution on 2026-07-26, which installed CLI version 0.0.24.
          curl -sSL https://cli.ghaymah.systems/install.sh | bash
          echo "$HOME/ghaymah/bin" >> "$GITHUB_PATH"

      - name: Deploy staging image
        shell: bash
        # The adapter exits 78 while Ghaymah's non-interactive authentication and
        # external-image update syntax remain unconfirmed, so it never claims a
        # deployment that did not happen. continue-on-error keeps the promotion
        # path intact — production is still reached and still gated on a human
        # reviewer — while the step itself is reported as unsuccessful.
        continue-on-error: true
        run: |
          bash scripts/ghaymah_deploy.sh \
            --app "${GHAYMAH_APP_NAME:-myapp-staging}" \
            --image "${DEPLOY_IMAGE}"

  deploy-production:
    name: Deploy to production
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment: production
    env:
      DEPLOY_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/ghaymah-api:${{ github.sha }}
      GHAYMAH_APP_NAME: ${{ vars.GHAYMAH_PRODUCTION_APP }}
      GHAYMAH_API_TOKEN: ${{ secrets.GHAYMAH_API_TOKEN }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Show production deployment target
        run: |
          echo "Image to deploy: ${DEPLOY_IMAGE}"
          echo "Ghaymah app: ${GHAYMAH_APP_NAME:-myapp-production}"

      - name: Install the documented Ghaymah CLI
        run: |
          # Official installer per https://ghaymah.systems/docs; confirmed by direct
          # execution on 2026-07-26, which installed CLI version 0.0.24.
          curl -sSL https://cli.ghaymah.systems/install.sh | bash
          echo "$HOME/ghaymah/bin" >> "$GITHUB_PATH"

      - name: Deploy production image
        shell: bash
        # Reached only after a required reviewer approves the production
        # environment. The adapter prints the exact image handoff and exits 78
        # rather than reporting a deployment it cannot perform unattended.
        run: |
          bash scripts/ghaymah_deploy.sh \
            --app "${GHAYMAH_APP_NAME:-myapp-production}" \
            --image "${DEPLOY_IMAGE}"