name: Проверка, сборка и развёртывание Magistr

on:
  push:
    branches:
      - main
    tags:
      - 'v*'

concurrency:
  group: magistr-production
  cancel-in-progress: false

env:
  REGISTRY: gitea.zuev.company
  BACKEND_IMAGE: zuev/magistr-backend
  FRONTEND_IMAGE: zuev/magistr-frontend

jobs:
  checks:
    name: Обязательные проверки
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Получить исходный код
        uses: actions/checkout@v4

      - name: Backend unit и component tests
        run: >-
          docker run --rm
          -v "${{ github.workspace }}/backend:/workspace"
          -w /workspace
          maven:3.9.9-eclipse-temurin-17
          mvn -Dapi.version=1.44 '-Dtest=!*IntegrationTest' test

      - name: Frontend static и unit tests
        run: >-
          docker run --rm
          -v "${{ github.workspace }}/frontend:/workspace"
          -w /workspace
          node:22-alpine3.23
          sh -c "npm ci && npm run check"

      - name: Проверить Docker Compose
        env:
          POSTGRES_PASSWORD: ci-config-only
          JWT_SECRET: ci-only-secret-not-for-runtime-0123456789abcdef0123456789abcdef
        run: docker compose config --quiet

      - name: Проверить сценарий immutable rollout и rollback
        run: bash scripts/test-deploy-images.sh

  build-and-push-backend:
    name: Собрать backend image
    needs: checks
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Получить исходный код
        uses: actions/checkout@v4

      - name: Войти в Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.ZUEV_TOKEN }}

      - name: Сформировать immutable tags и labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}
          flavor: latest=false
          tags: |
            type=sha,format=long,prefix=sha-
            type=ref,event=tag

      - name: Собрать и опубликовать backend image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  build-and-push-frontend:
    name: Собрать frontend image
    needs: checks
    runs-on: ubuntu-latest
    timeout-minutes: 20
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Получить исходный код
        uses: actions/checkout@v4

      - name: Войти в Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.ZUEV_TOKEN }}

      - name: Сформировать immutable tags и labels
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}
          flavor: latest=false
          tags: |
            type=sha,format=long,prefix=sha-
            type=ref,event=tag

      - name: Собрать и опубликовать frontend image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: |
            ${{ steps.meta.outputs.labels }}
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  deploy-to-k8s:
    name: Развернуть проверенные digests
    needs: [build-and-push-backend, build-and-push-frontend]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: production
    env:
      BACKEND_REF: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}@${{ needs.build-and-push-backend.outputs.digest }}
      FRONTEND_REF: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}@${{ needs.build-and-push-frontend.outputs.digest }}
      KUBECTL_VERSION: v1.33.12
      KUBECTL_SHA256: fe80ae4133b44fa2077db4af144e80765eb1b3b2eede55fbff6933c4374d8c6e
    steps:
      - name: Получить deploy-скрипт
        uses: actions/checkout@v4

      - name: Создать kubeconfig
        env:
          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG_DATA }}
        run: |
          install -d -m 700 "$HOME/.kube"
          printf '%s' "$KUBECONFIG_DATA" | base64 --decode > "$HOME/.kube/config"
          chmod 600 "$HOME/.kube/config"

      - name: Установить проверенный kubectl
        run: |
          curl --fail --show-error --silent --location --retry 3 \
            --output kubectl \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          echo "${KUBECTL_SHA256}  kubectl" | sha256sum --check --strict
          sudo install -m 0755 kubectl /usr/local/bin/kubectl

      - name: Применить digests и проверить rollout
        run: bash scripts/deploy-images.sh "$BACKEND_REF" "$FRONTEND_REF"