# Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner.
#
# Triggers: push to master/main, or manual workflow_dispatch.
#
# Repository Variables (Settings → Actions → Variables):
#   REGISTRY_HOST        Docker registry host:port (no http/https). Same PC as Gitea → 127.0.0.1:3000
#   REGISTRY_OWNER       Gitea user or org that owns the packages
#   PUBLIC_BASE_URL      URL users sopen in browser, e.g. http://178.131.50.201:8088  (no trailing slash)
#   DEPLOY_SECRETS_DIR   absolute path on runner, e.g. C:/dyolink/secrets
#
# Optional:
#   STAGING_HTTP_PORT    public port (default 8088) — Windows portproxy listens here
#   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal 8088 if portproxy owns 8088
#   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
#
# Same Windows PC runs Gitea + runner + deploy:
#   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
#   REGISTRY_HOST        → host.docker.internal:3000  (docker commands run inside Docker Desktop VM)
#   Gitea app.ini ROOT_URL → http://host.docker.internal:3000/
#   PUBLIC_BASE_URL      → public IP:8088 (browser URL for staging app)
#
# Add host.docker.internal:3000 to Docker Desktop insecure-registries.
#
# Repository Secrets (Settings → Actions → Secrets):
#   REGISTRY_USERNAME    Gitea username for docker login
#   REGISTRY_PASSWORD    Gitea access token (packages:read/write) or account password
#
# Docker on runner: add registry hosts to insecure-registries, e.g. ["127.0.0.1:3000","178.131.50.201:3000"]
#
# Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).

name: Registry — build, push, deploy

on:
  push:
    branches: [main, master]
  workflow_dispatch:

defaults:
  run:
    shell: powershell

jobs:
  build-and-push:
    runs-on: windows
    outputs:
      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - name: Checkout (clone from this Gitea — no gitea.com)
        run: |
          $ErrorActionPreference = 'Stop'
          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
            $Server = "${{ github.server_url }}".TrimEnd('/')
          } elseif ($cloneHost -match '^https?://') {
            $Server = $cloneHost.TrimEnd('/')
          } else {
            $Server = 'http://' + $cloneHost
          }
          $Repo = "${{ github.repository }}"
          $Branch = "${{ github.ref_name }}"
          $Token = "${{ github.token }}"
          $Actor = "${{ github.actor }}"
          $hp = $Server -replace '^https?://', ''
          if ($Server.StartsWith('https')) {
            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
          } else {
            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
          }
          $env:GIT_TERMINAL_PROMPT = '0'
          git clone --depth 1 --branch $Branch $cloneUrl .

      - name: Image tag and registry prefix
        id: meta
        run: |
          $ErrorActionPreference = 'Stop'
          $short = (git rev-parse --short HEAD).Trim()
          $utf8 = New-Object System.Text.UTF8Encoding $false
          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)

      - name: Log in to container registry
        run: |
          $ErrorActionPreference = 'Stop'
          $pass = @'
          ${{ secrets.REGISTRY_PASSWORD }}
          '@
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: Build and push backend
        run: |
          $ErrorActionPreference = 'Stop'
          $tag = "${{ steps.meta.outputs.image_tag }}"
          docker build `
            -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
            -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
            ./backend
          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
          docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"

      - name: Build and push frontend
        env:
          PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
        run: |
          $ErrorActionPreference = 'Stop'
          $tag = "${{ steps.meta.outputs.image_tag }}"
          $base = $env:PUBLIC_BASE_URL
          docker build `
            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
            -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
            ./frontend
          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"

  deploy:
    needs: build-and-push
    runs-on: windows
    steps:
      - name: Checkout (shallow clone from this Gitea — no gitea.com)
        run: |
          $ErrorActionPreference = 'Stop'
          $cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($cloneHost)) {
            $Server = "${{ github.server_url }}".TrimEnd('/')
          } elseif ($cloneHost -match '^https?://') {
            $Server = $cloneHost.TrimEnd('/')
          } else {
            $Server = 'http://' + $cloneHost
          }
          $Repo = "${{ github.repository }}"
          $Branch = "${{ github.ref_name }}"
          $Token = "${{ github.token }}"
          $Actor = "${{ github.actor }}"
          $hp = $Server -replace '^https?://', ''
          if ($Server.StartsWith('https')) {
            $cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
          } else {
            $cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
          }
          $env:GIT_TERMINAL_PROMPT = '0'
          git clone --depth 1 --branch $Branch $cloneUrl .

      - name: Write deploy.registry.env and validate secrets path
        run: |
          $ErrorActionPreference = 'Stop'
          $SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($SD)) {
            Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
            Write-Host "where database.staging.env and backend.staging.env live (not in git)."
            exit 1
          }
          if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
            Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
            exit 1
          }
          if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
            Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
            exit 1
          }
          $stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '8088' }
          $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
          $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
          $lines = @(
            "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
            "IMAGE_TAG=$imageTag",
            "STAGING_HTTP_PORT=$stagingPort",
            "STAGING_LOCAL_PORT=$localPort",
            "DEPLOY_SECRETS_DIR=$SD"
          )
          Set-Location infrastructure
          $lines | Set-Content -Path deploy.registry.env -Encoding utf8

      - name: Log in to container registry (for pull)
        run: |
          $ErrorActionPreference = 'Stop'
          $pass = @'
          ${{ secrets.REGISTRY_PASSWORD }}
          '@
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin

      - name: Pull and start stack
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location infrastructure
          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d