name: Build & Deploy to Ghaymah

on:
  push:
    branches:
      - main

jobs:
  build-and-push:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Source Code
        uses: actions/checkout@v4

      - name: Build Docker Image
        run: |
          docker build -t ghaymah-app:${{ github.sha }} .

      # Login to Ghaymah Container Registry
      # Store credentials as GitHub Secrets
      - name: Login to Ghaymah Registry
        run: |
          echo "${{ secrets.GHAYMAH_REGISTRY_PASSWORD }}" | docker login ${{ secrets.GHAYMAH_REGISTRY }} \
          -u "${{ secrets.GHAYMAH_REGISTRY_USERNAME }}" \
          --password-stdin

      - name: Tag Docker Image
        run: |
          docker tag ghaymah-app:${{ github.sha }} \
          ${{ secrets.GHAYMAH_REGISTRY }}/ghaymah-app:${{ github.sha }}

      - name: Push Docker Image
        run: |
          docker push \
          ${{ secrets.GHAYMAH_REGISTRY }}/ghaymah-app:${{ github.sha }}

  deploy-staging:
    name: Deploy to Staging
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: staging

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Install Ghaymah CLI
        run: |
          curl -sSl https://cli.ghaymah.systems/install.sh | bash

      - name: Login to Ghaymah
        run: |
          gy auth login --token "${{ secrets.GHAYMAH_API_TOKEN }}"

      - name: Deploy to Staging
        run: |
          gy resource app launch

  deploy-production:
    name: Deploy to Production
    needs: deploy-staging
    runs-on: ubuntu-latest

    # Configure this environment in GitHub:
    # Settings → Environments → production
    # Add Required Reviewers to enable manual approval.
    environment:
      name: production

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Install Ghaymah CLI
        run: |
          curl -sSl https://cli.ghaymah.systems/install.sh | bash

      - name: Login to Ghaymah
        run: |
          gy auth login --token "${{ secrets.GHAYMAH_API_TOKEN }}"

      - name: Deploy to Production
        run: |
          gy resource app launch