name: Central Deploy
on:
  workflow_dispatch:
    inputs:
      repo_name:
        description: 'Repository to build and deploy (e.g., narng-api)'
        required: true
        type: string
      branch:
        description: 'Branch to deploy'
        required: true
        default: 'dev'
        type: string

env:
  REGISTRY: 192.168.1.8:8084
  COMPOSE_PATH: /srv/staging/narng-platform/compose
  ORG: narng-platform

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout service code
        uses: actions/checkout@v4
        with:
          repository: ${{ env.ORG }}/${{ inputs.repo_name }}
          ref: ${{ inputs.branch }}
          token: ${{ secrets.NARNG_GIT_TOKEN }}
          fetch-depth: 0

      - name: Detect service metadata
        id: meta
        run: |
          REPO_NAME="${{ inputs.repo_name }}"
          case "$REPO_NAME" in
            narng-api-laravel)            SERVICE="laravel"; TAG_VAR="LARAVEL_TAG" ;;
            narng-api|narng-api-gateway)  SERVICE="api";    TAG_VAR="API_TAG" ;;
            narng-web-app)                SERVICE="web";    TAG_VAR="WEB_TAG" ;;
            *)
              SERVICE=$(echo "$REPO_NAME" | sed 's/^narng-//')
              TAG_VAR=$(echo "$SERVICE" | tr '[:lower:]' '[:upper:]')_TAG
              ;;
          esac
          echo "service=$SERVICE"  >> $GITHUB_OUTPUT
          echo "tag_var=$TAG_VAR"  >> $GITHUB_OUTPUT
          echo "image=${{ env.REGISTRY }}/${{ env.ORG }}/$REPO_NAME" >> $GITHUB_OUTPUT
          echo "version=1.0.0-dev.${{ github.run_number }}" >> $GITHUB_OUTPUT

      - name: Prepare SSH key
        env:
          STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
        run: |
          echo "$STAGING_SSH_KEY" > /tmp/deploy_key_raw
          if head -1 /tmp/deploy_key_raw | grep -q "BEGIN OPENSSH PRIVATE KEY"; then
            cp /tmp/deploy_key_raw /tmp/deploy_key
          else
            base64 -d /tmp/deploy_key_raw > /tmp/deploy_key
          fi
          chmod 600 /tmp/deploy_key
          ssh-keygen -l -f /tmp/deploy_key || { echo "ERROR: Invalid SSH key"; exit 1; }

      - name: Login to Nexus
        run: echo "${{ secrets.NEXUS_PASS }}" | docker login ${{ env.REGISTRY }} -u "${{ secrets.NEXUS_USER }}" --password-stdin

      - name: Build Docker image
        env:
          DOCKER_BUILDKIT: 1
        run: |
          IMAGE=${{ steps.meta.outputs.image }}
          VERSION=${{ steps.meta.outputs.version }}
          docker buildx build \
            --builder default \
            --no-cache \
            --tag "$IMAGE:$VERSION" \
            --tag "$IMAGE:1.0.0-latest" \
            --load . 2>&1 | tail -30

      - name: Push to Nexus
        run: |
          IMAGE=${{ steps.meta.outputs.image }}
          VERSION=${{ steps.meta.outputs.version }}
          docker push "$IMAGE:$VERSION"
          docker push "$IMAGE:1.0.0-latest"

      - name: Deploy to staging via SSH
        uses: appleboy/ssh-action@v1.0.3
        env:
          NEXUS_USER: ${{ secrets.NEXUS_USER }}
          NEXUS_PASS: ${{ secrets.NEXUS_PASS }}
          SERVICE: ${{ steps.meta.outputs.service }}
          VERSION: ${{ steps.meta.outputs.version }}
          TAG_VAR: ${{ steps.meta.outputs.tag_var }}
          REGISTRY: ${{ env.REGISTRY }}
          COMPOSE_PATH: ${{ env.COMPOSE_PATH }}
        with:
          host: ${{ secrets.STAGING_HOST }}
          username: ${{ secrets.STAGING_USER }}
          key_path: /tmp/deploy_key
          port: 2222
          envs: NEXUS_USER,NEXUS_PASS,SERVICE,VERSION,TAG_VAR,REGISTRY,COMPOSE_PATH
          script: |
            set -ex
            echo "Deploying $SERVICE:$VERSION"
            echo "$NEXUS_PASS" | docker login "$REGISTRY" -u "$NEXUS_USER" --password-stdin
            sed -i "s|^${TAG_VAR}=.*|${TAG_VAR}=${VERSION}|" "$COMPOSE_PATH/.env"
            cd "$COMPOSE_PATH"
            docker compose pull "$SERVICE"
            docker compose up -d --force-recreate --no-deps "$SERVICE"
            docker image prune -f
            echo "✅ $SERVICE:$VERSION deployed"