name: Deploy STEP3 Questions API

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

jobs:
  deploy:
    runs-on: self-hosted

    env:
      IMAGE_NAME: step3-questions:latest
      IMAGE_TAR: /tmp/step3-questions.tar
      NODES: "192.168.86.72 192.168.86.73 192.168.86.74"

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: Build Docker image
        run: |
          cd api/QuestionsApi
          docker build -t "${IMAGE_NAME}" .

      - name: Save Docker image to TAR
        run: |
          docker save "${IMAGE_NAME}" -o "${IMAGE_TAR}"

      - name: Copy TAR to nodes
        run: |
          for node in ${NODES}; do
            echo "Copying image tar to $node ..."
            scp -o StrictHostKeyChecking=no "${IMAGE_TAR}" hz@"$node":/tmp/step3-questions.tar
          done

      - name: Import image on nodes
        run: |
          for node in ${NODES}; do
            echo "Importing image on $node ..."
            ssh -o StrictHostKeyChecking=no hz@"$node" "sudo ctr -n k8s.io images import /tmp/step3-questions.tar"
          done

      - name: Clean TAR from nodes
        run: |
          for node in ${NODES}; do
            echo "Removing image tar on $node ..."
            ssh -o StrictHostKeyChecking=no hz@"$node" "rm -f /tmp/step3-questions.tar"
          done

      - name: Clean TAR on runner
        run: |
          rm -f "${IMAGE_TAR}"

      - name: Configure kubeconfig
        env:
          KUBECONFIG_CONTENT: ${{ secrets.KUBECONFIG }}
        run: |
          if [ -n "$KUBECONFIG_CONTENT" ]; then
            mkdir -p /tmp/kube
            printf '%s\n' "$KUBECONFIG_CONTENT" > /tmp/kube/config
            echo "KUBECONFIG=/tmp/kube/config" >> "$GITHUB_ENV"
            echo "Using kubeconfig from KUBECONFIG secret."
          else
            echo "KUBECONFIG secret is not set for this repo; using runner default kubeconfig."
          fi

      - name: Create namespace if missing
        run: |
          kubectl create namespace step3-questions --dry-run=client -o yaml | kubectl apply -f -

      - name: Configure internal API secret
        env:
          INTERNAL_PURGE_SECRET: ${{ secrets.INTERNAL_PURGE_SECRET }}
        run: |
          test -n "$INTERNAL_PURGE_SECRET"
          kubectl create secret generic medmind-internal-api \
            --from-literal=purge-secret="$INTERNAL_PURGE_SECRET" \
            --dry-run=client -o yaml | kubectl apply -n step3-questions -f -

      - name: Configure Stripe secrets
        env:
          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
        run: |
          test -n "$STRIPE_SECRET_KEY"
          test -n "$STRIPE_WEBHOOK_SECRET"
          kubectl create secret generic medmind-stripe \
            --from-literal=secret-key="$STRIPE_SECRET_KEY" \
            --from-literal=webhook-secret="$STRIPE_WEBHOOK_SECRET" \
            --dry-run=client -o yaml | kubectl apply -n step3-questions -f -

      - name: Configure authentication secrets
        env:
          AUTH_JWT_KEY: ${{ secrets.AUTH_JWT_KEY }}
        run: |
          test -n "$AUTH_JWT_KEY"
          kubectl create secret generic ranaze-auth \
            --from-literal=jwt-key="$AUTH_JWT_KEY" \
            --dry-run=client -o yaml | kubectl apply -n step3-questions -f -

      - name: Apply Questions deployment & service
        run: |
          kubectl apply -f api/QuestionsApi/k8s/deployment.yaml -n step3-questions
          kubectl apply -f api/QuestionsApi/k8s/service.yaml -n step3-questions

      - name: Restart Questions deployment
        run: |
          kubectl rollout restart deployment/step3-questions -n step3-questions
          kubectl rollout status deployment/step3-questions -n step3-questions