name: CI/CD - Build & Deploy to Ghaymah Cloud

on:
  push:
    branches:
      - main       # production
      - develop    # staging
  pull_request:
    branches:
      - main

jobs:
  # ---------------------------------------------------------
  # 1) BUILD & TEST — runs on every push / PR, no approval needed
  # ---------------------------------------------------------
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5.0.0

      - name: Build Docker image (validation only)
        run: docker build -t exam-api:${{ github.sha }} .

      - name: Smoke test the image locally
        run: |
          docker run -d -p 5000:5000 --name smoke-test exam-api:${{ github.sha }}
          sleep 5
          curl -f http://localhost:5000/health || (docker logs smoke-test && exit 1)
          docker stop smoke-test

  # ---------------------------------------------------------
  # 2) DEPLOY TO STAGING — automatic, no approval
  #    Triggers when pushing to "develop"
  # ---------------------------------------------------------
  deploy-staging:
    needs: build-and-test
    if: github.ref == 'refs/heads/develop' && github.event_name == 'push'
    runs-on: ubuntu-latest
    environment: staging   # no required reviewers configured on this one
    steps:
      - name: Checkout code
        uses: actions/checkout@v5.0.0

      - name: Install Ghaymah CLI
        run: curl -sSL https://cli.ghaymah.systems/install.sh | bash

      - name: Login to Ghaymah
        run: $HOME/ghaymah/bin/gy auth login --email "${{ secrets.GHAYMAH_EMAIL }}" --password "${{ secrets.GHAYMAH_PW }}"

      - name: Use staging config
        run: cp .ghaymah.staging.json .ghaymah.json

      - name: Deploy to Ghaymah (staging)
        run: $HOME/ghaymah/bin/gy resource app launch

  # ---------------------------------------------------------
  # 3) DEPLOY TO PRODUCTION — requires manual approval
  #    Triggers when pushing to "main"
  #    The "environment: production" below is what enforces the
  #    approval gate — set "Required reviewers" on this environment
  #    in: Repo Settings -> Environments -> production
  # ---------------------------------------------------------
  deploy-production:
    needs: build-and-test
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    environment: production   # <-- manual approval enforced here
    steps:
      - name: Checkout code
        uses: actions/checkout@v5.0.0

      - name: Install Ghaymah CLI
        run: curl -sSL https://cli.ghaymah.systems/install.sh | bash

      - name: Login to Ghaymah
        run: $HOME/ghaymah/bin/gy auth login --email "${{ secrets.GHAYMAH_EMAIL }}" --password "${{ secrets.GHAYMAH_PW }}"

      - name: Use production config
        run: cp .ghaymah.production.json .ghaymah.json

      - name: Deploy to Ghaymah (production)
        run: $HOME/ghaymah/bin/gy resource app launch