name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/api-gateway
  DOCKER_HOST: tcp://localhost:2375

jobs:
  ci:
    name: CI
    runs-on: golang
    steps:
      - name: Install dependencies
        run: |
          apt-get update
          apt-get install -y docker.io curl
          curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x kubectl && mv kubectl /usr/local/bin/
          kubectl version --client

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Go vet
        run: go vet ./...

      - name: Go test
        run: go test ./...

      - name: Get short SHA
        id: sha
        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Registry login
        run: |
          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
            --username "${REGISTRY_USER}" --password-stdin
        env:
          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}

      - name: Build Docker image
        run: |
          docker build --no-cache \
            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
            -f Dockerfile .

      - name: Push image (SHA tag)
        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"

      # ── Tekton integration tests ─────────────────────────────
      - name: Setup kubeconfig
        run: |
          mkdir -p ~/.kube
          echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
          kubectl cluster-info
        env:
          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}

      - name: Trigger Tekton PipelineRun
        id: tekton
        run: |
          SHA="${{ steps.sha.outputs.short_sha }}"
          RUN_NAME="integration-test-${SHA}"

          # Clean up any previous run with the same name
          kubectl delete pipelinerun "${RUN_NAME}" -n api --ignore-not-found

          # Create PipelineRun — spins up gateway sidecar + curl tests
          cat <<YAML | kubectl create -f -
          apiVersion: tekton.dev/v1
          kind: PipelineRun
          metadata:
            name: ${RUN_NAME}
            namespace: api
            labels:
              commit-sha: "${SHA}"
          spec:
            pipelineRef:
              name: integration-test-pipeline
            params:
            - name: image
              value: "${IMAGE}:${SHA}"
          YAML

          echo "✓ PipelineRun created: ${RUN_NAME}"

          # Wait for completion (Succeeded or Failed)
          echo "Waiting for tests (timeout 5m)..."
          if kubectl wait pipelinerun/"${RUN_NAME}" -n api \
               --for=condition=Succeeded --timeout=5m 2>/dev/null; then
            echo "result=pass" >> $GITHUB_OUTPUT
          else
            echo "result=fail" >> $GITHUB_OUTPUT
          fi

          # Print logs + results
          echo ""
          echo "=== Test Logs ==="
          kubectl logs -n api "pipelinerun/${RUN_NAME}" --all-containers 2>/dev/null || true
          echo ""
          REASON=$(kubectl get pipelinerun "${RUN_NAME}" -n api \
            -o jsonpath='{.status.conditions[0].reason}')
          SUMMARY=$(kubectl get pipelinerun "${RUN_NAME}" -n api \
            -o jsonpath='{.status.results[?(@.name=="test-summary")].value}')
          echo "Status: ${REASON}"
          echo "Summary: ${SUMMARY}"

      - name: Gate on test result
        if: steps.tekton.outputs.result != 'pass'
        run: |
          echo "✗ Integration tests FAILED — image NOT promoted"
          exit 1

      # ── Promote only after tests pass ────────────────────────
      - name: Promote image to latest
        run: |
          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
          docker push "${IMAGE}:latest"
          echo "✓ Promoted to latest"

      - name: Cleanup
        if: always()
        run: docker image prune -af 2>&1 | tail -3 || true