name: Deploy Prod

on:
  push:
    branches: [ "main" ]
    paths:
      - 7project/backend/**
      - 7project/frontend/**
      - 7project/charts/myapp-chart/**
      - .github/workflows/deploy-prod.yaml
      - .github/workflows/build-image.yaml
      - .github/workflows/frontend-pages.yml
  workflow_dispatch:


permissions:
  contents: read

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  build:
    name: Build and push image (reusable)
    uses: ./.github/workflows/build-image.yaml
    with:
      mode: prod
      image_repo: lukastrkan/cc-app-demo
      context: 7project/backend
    secrets: inherit

  frontend:
    name: Frontend - Build and Deploy to Cloudflare Pages (prod)
    uses: ./.github/workflows/frontend-pages.yml
    with:
      mode: prod
    secrets: inherit

  deploy:
    name: Helm upgrade/install (prod)
    runs-on: vhs
    needs: [build, frontend]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Helm
        uses: azure/setup-helm@v4

      - name: Setup kubectl
        uses: azure/setup-kubectl@v4

      - name: Configure kubeconfig
        env:
          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
        run: |
          mkdir -p ~/.kube
          if [ -z "$KUBE_CONFIG" ]; then
            echo "Secret KUBE_CONFIG is required (kubeconfig content)"; exit 1; fi
          echo "$KUBE_CONFIG" > ~/.kube/config
          chmod 600 ~/.kube/config

      - name: Helm upgrade/install prod
        env:
          DOMAIN: ${{ secrets.PROD_DOMAIN }}
          RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
          DIGEST: ${{ needs.build.outputs.digest }}
        run: |
          if [ -z "$DOMAIN" ]; then
            echo "Secret PROD_DOMAIN is required (e.g., app.example.com)"; exit 1; fi
          if [ -z "$RABBITMQ_PASSWORD" ]; then
            echo "Secret PROD_RABBITMQ_PASSWORD is required"; exit 1; fi
          if [ -z "$DB_PASSWORD" ]; then
            echo "Secret PROD_DB_PASSWORD is required"; exit 1; fi
          if [ -z "$IMAGE_REPO" ]; then IMAGE_REPO="lukastrkan/cc-app-demo"; fi
          helm upgrade --install myapp ./7project/charts/myapp-chart \
            -n prod --create-namespace \
            -f 7project/charts/myapp-chart/values-prod.yaml \
            --set deployment="prod" \
            --set domain="$DOMAIN" \
            --set image.repository="$IMAGE_REPO" \
            --set image.digest="$DIGEST" \
            --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
            --set-string database.password="$DB_PASSWORD"