name: Deploy Prod

on:
  push:
    branches: [ "main" ]
    paths:
      - 7project/backend/**
  workflow_dispatch:


permissions:
  contents: read

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  deploy:
    name: Helm upgrade/install (prod)
    runs-on: vhs
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Helm
        uses: azure/setup-helm@v4

      - name: Setup kubectl
        uses: azure/setup-kubectl@v4

      - name: Configure kubeconfig
        env:
          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
        run: |
          mkdir -p ~/.kube
          if [ -z "$KUBE_CONFIG" ]; then
            echo "Secret KUBE_CONFIG is required (kubeconfig content)"; exit 1; fi
          echo "$KUBE_CONFIG" > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Compute image repo and tags (prod)
        run: |
          IMAGE_REPO="${IMAGE_REPO:-lukastrkan/cc-app-demo}"
          echo "IMAGE_REPO=$IMAGE_REPO" >> $GITHUB_ENV
          SHA_SHORT="${GITHUB_SHA::12}"
          echo "TAG1=prod-$SHA_SHORT" >> $GITHUB_ENV
          echo "TAG2=latest" >> $GITHUB_ENV

      - name: Build and push image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: 7project/backend
          push: true
          tags: |
            ${{ env.IMAGE_REPO }}:${{ env.TAG1 }}
            ${{ env.IMAGE_REPO }}:${{ env.TAG2 }}
          platforms: linux/amd64

      - name: Helm upgrade/install prod
        env:
          DOMAIN: ${{ secrets.PROD_DOMAIN }}
          RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
          IMAGE_REPO: ${{ env.IMAGE_REPO }}
        run: |
          if [ -z "$DOMAIN" ]; then
            echo "Secret PROD_DOMAIN is required (e.g., app.example.com)"; exit 1; fi
          if [ -z "$RABBITMQ_PASSWORD" ]; then
            echo "Secret PROD_RABBITMQ_PASSWORD is required"; exit 1; fi
          if [ -z "$DB_PASSWORD" ]; then
            echo "Secret PROD_DB_PASSWORD is required"; exit 1; fi
          DIGEST="${{ steps.build.outputs.digest }}"
          if [ -z "$IMAGE_REPO" ]; then IMAGE_REPO="lukastrkan/cc-app-demo"; fi
          helm upgrade --install myapp ./7project/charts/myapp-chart \
            -n prod --create-namespace \
            -f 7project/charts/myapp-chart/values-prod.yaml \
            --set domain="$DOMAIN" \
            --set image.repository="$IMAGE_REPO" \
            --set image.digest="$DIGEST" \
            --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
            --set-string database.password="$DB_PASSWORD"