name: Deploy (dev, k3s)

# Auto-deploys main to the dev k3s cluster via Helm after CI passes (M24-5), pinning the release
# to the exact SHA-tagged image CI pushed (build-once, deploy-many - the M15 semantics, with
# `helm rollback` as the undo). Runs IN PARALLEL with the compose deploy (deploy-dev.yml) until
# the documented cutover flips the exe.dev edge to Traefik - runbook in docs/deployment.md.
# Each run first syncs the sealed secrets (M24-4), so pods always roll out with current config.
on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]
  workflow_dispatch:

concurrency:
  # Share the dev-deploy lock: the compose deploy, secret sync, and helm deploy/rollback all
  # SSH the same VM and must serialize.
  group: deploy-dev
  cancel-in-progress: false

jobs:
  deploy:
    # Auto runs deploy only when CI succeeded; manual runs always proceed.
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: bloom-arc
    environment: dev
    # packages: read lets the ghcr-pull imagePullSecret be refreshed with the workflow token.
    permissions:
      contents: read
      packages: read
    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          # Deploy the exact commit CI built (its image is tagged by that SHA); fall back to main
          # tip for a manual dispatch.
          ref: ${{ github.event.workflow_run.head_sha || 'main' }}

      - name: Sync sealed secrets to the cluster
        env:
          SECRETS_JSON: ${{ toJSON(secrets) }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: bash scripts/deploy/k8s-secrets-dev.sh

      - name: Compute the image tag to deploy
        id: img
        run: echo "tag=sha-$(git rev-parse HEAD | cut -c1-12)" >> "$GITHUB_OUTPUT"

      # Resolve the admin dashboard's canonical Cloudflare Pages origin from Cloudflare (#535), so
      # BLOOM_ADMIN_DASHBOARD_URL always matches the real project subdomain. Best-effort: on any
      # failure this emits an empty origin and helm-dev.sh keeps the values-dev.yaml default.
      - name: Resolve admin dashboard origin from Cloudflare
        id: admin_origin
        env:
          CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CF_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
          CF_ADMIN_PROJECT: ${{ vars.CLOUDFLARE_ADMIN_PAGES_PROJECT || 'bloom-admin' }}
        run: bash scripts/deploy/resolve-admin-origin.sh

      - name: Deploy to the dev k3s cluster via Helm
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          BLOOM_IMAGE_TAG: ${{ steps.img.outputs.tag }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Empty when the lookup fell back; helm-dev.sh then keeps the git-visible chart default.
          BLOOM_ADMIN_DASHBOARD_URL: ${{ steps.admin_origin.outputs.origin }}
        run: bash scripts/deploy/helm-dev.sh