name: Deploy (dev, k3s)

# Auto-deploys main to the dev k3s cluster via Helm after CI passes (M24-5), pinning the release
# to the exact SHA-tagged image CI pushed (build-once, deploy-many - the M15 semantics, with
# `helm rollback` as the undo). Runs IN PARALLEL with the compose deploy (deploy-dev.yml) until
# the documented cutover flips the exe.dev edge to Traefik - runbook in docs/deployment.md.
# Each run first syncs the sealed secrets (M24-4), so pods always roll out with current config.
on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]
  workflow_dispatch:

concurrency:
  # Share the dev-deploy lock: the compose deploy, secret sync, and helm deploy/rollback all
  # SSH the same VM and must serialize.
  group: deploy-dev
  cancel-in-progress: false

jobs:
  deploy:
    # Auto runs deploy only when CI succeeded; manual runs always proceed.
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: bloom-arc
    environment: dev
    # packages: read lets the ghcr-pull imagePullSecret be refreshed with the workflow token.
    permissions:
      contents: read
      packages: read
    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          # Deploy the exact commit CI built (its image is tagged by that SHA); fall back to main
          # tip for a manual dispatch.
          ref: ${{ github.event.workflow_run.head_sha || 'main' }}

      - name: Sync sealed secrets to the cluster
        env:
          SECRETS_JSON: ${{ toJSON(secrets) }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: bash scripts/deploy/k8s-secrets-dev.sh

      - name: Compute the image tag to deploy
        id: img
        run: echo "tag=sha-$(git rev-parse HEAD | cut -c1-12)" >> "$GITHUB_OUTPUT"

      # The dashboard/admin/API origins are the committed hiddenclaw.org custom domains in
      # values-dev.yaml (M48-1); the #535 deploy-time lookup of the admin project's pages.dev
      # subdomain is gone with them - a custom domain does not drift with the Pages project.
      - name: Deploy to the dev k3s cluster via Helm
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          BLOOM_IMAGE_TAG: ${{ steps.img.outputs.tag }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash scripts/deploy/helm-dev.sh

      # Post-deploy LLM smoke check (M51-1, #942): the /health gate above proves the pod is up,
      # but not that it can authenticate to the OpenClaw po-gateway. Run bloom's exact
      # /v1/chat/completions from inside the pod and fail the deploy on a 401/403, 5xx, or an
      # unreachable gateway, so a drifted po-gateway token surfaces as a red deploy instead of a
      # silent "briefly overloaded" chat. A provider rate limit (429) proves the gateway is up
      # and accepted the token, so it passes with a warning instead of blocking the release
      # (#989) - the step summary names the rate-limited models and the quota reset time.
      - name: Post-deploy LLM smoke check (OpenClaw chat completions)
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: bash scripts/deploy/smoke-llm-dev.sh