name: Rollback (dev, k3s)

# Manually roll the dev k3s release back with `helm rollback` (M24-5): no revision input means
# the previous revision - the same one-click "undo the last deploy" the compose rollback
# (deploy-rollback-dev.yml) gives, but from helm's in-cluster revision history instead of the
# .deployed_tag_prev file. Health-gated like the deploy: probes (--wait) + /health through the
# ingress. List revisions with `helm history bloom -n bloom` on the VM.

on:
  workflow_dispatch:
    inputs:
      revision:
        description: "Helm revision to roll back to (empty = the previous revision)"
        required: false
        default: ""

concurrency:
  # Share the dev-deploy lock so a rollback can never race a deploy or secret sync.
  group: deploy-dev
  cancel-in-progress: false

jobs:
  rollback:
    runs-on: bloom-arc
    environment: dev
    # packages: read lets the ghcr-pull imagePullSecret be refreshed, in case the rolled-back
    # image was evicted from the node and must be re-pulled.
    permissions:
      contents: read
      packages: read
    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Roll back the dev k3s release
        env:
          MODE: rollback
          HELM_REVISION: ${{ inputs.revision }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash scripts/deploy/helm-dev.sh