name: CI/CD Pipeline

on:
  push:
    branches:
      - main
      - dev
      - "feature/**"
  pull_request:
    branches:
      - main
      - dev

env:
  PYTHON_VERSION: "3.11"
  REGISTRY_HOST: "10.10.0.10:3000"
  WEB_IMAGE: "mostovik-web"
  CELERY_IMAGE: "mostovik-celery"

jobs:
  lint:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    if: ${{ !contains(github.event.head_commit.message, '#no_lint') }}

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y software-properties-common
          add-apt-repository -y ppa:deadsnakes/ppa
          apt-get update
          apt-get install -y python3.11 python3.11-venv
          curl -LsSf https://astral.sh/uv/install.sh | sh

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          uv venv --python python3.11
          . .venv/bin/activate
          uv sync --dev --frozen

      - name: Run Ruff linting
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff check src

      - name: Run Ruff formatting check
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff format src --check

      - name: Telegram notify (lint failed)
        if: failure()
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="❌ [mostovik-backend] lint failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}"

          curl -fsS -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"

  test:
    name: Run Tests
    runs-on: ubuntu-latest
    if: ${{ !contains(github.event.head_commit.message, '#no_test') }}

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          apt-get update
          apt-get install -y software-properties-common
          add-apt-repository -y ppa:deadsnakes/ppa
          apt-get update
          apt-get install -y python3.11 python3.11-venv
          curl -LsSf https://astral.sh/uv/install.sh | sh

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$PATH"
          uv venv --python python3.11
          . .venv/bin/activate
          uv sync --dev --frozen

      - name: Run Django tests
        env:
          DJANGO_SETTINGS_MODULE: settings.test
          SECRET_KEY: test-secret-key-for-ci
        run: |
          set -euo pipefail
          . .venv/bin/activate
          export PYTHONPATH="${PWD}/src:${PYTHONPATH:-}"
          python src/manage.py test tests --verbosity=2

      - name: Telegram notify (test failed)
        if: failure()
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="❌ [mostovik-backend] test failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}"

          curl -fsS -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"

  build_push:
    name: Build & Push Images
    runs-on: ubuntu-latest
    needs: [lint, test]
    if: |
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') &&
      (needs.lint.result == 'success' || needs.lint.result == 'skipped') &&
      (needs.test.result == 'success' || needs.test.result == 'skipped')

    steps:
      - name: Checkout code
        run: |
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Build and push images
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          curl -sL https://github.com/google/go-containerregistry/releases/download/v0.19.0/go-containerregistry_Linux_x86_64.tar.gz | tar xz crane
          chmod +x crane

          BRANCH_TAG=$(echo "${GITHUB_REF_NAME}" | sed 's/\//-/g')
          SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
          REPO_OWNER="${GITHUB_REPOSITORY%%/*}"
          REGISTRY="${REGISTRY_HOST}/${REPO_OWNER}"
          GITEA_HOST=$(echo "${GITHUB_SERVER_URL}" | sed -E 's#https?://([^/:]+).*#\1#')

          echo "Registry: ${REGISTRY_HOST}"
          echo "Actor: ${GITHUB_ACTOR}"
          echo "Gitea host: ${GITEA_HOST}"

          # Ensure token endpoint host resolves to internal network IP from runner.
          # Registry auth flow may redirect to ${GITEA_HOST} even when pushing to REGISTRY_HOST.
          echo "10.10.0.10 ${GITEA_HOST}" >> /etc/hosts
          getent hosts "${GITEA_HOST}" || true

          # Some runners have outbound proxy env configured; force direct access
          # to internal registry/gitea hosts for auth flow.
          unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY
          export NO_PROXY="${NO_PROXY:-},10.10.0.10,${GITEA_HOST}"
          export no_proxy="${no_proxy:-},10.10.0.10,${GITEA_HOST}"

          echo "${REGISTRY_PASSWORD}" | ./crane auth login --insecure "${REGISTRY_HOST}" -u "${REGISTRY_USER}" --password-stdin

          docker build \
            -f ./docker/Dockerfile \
            --target runtime-web \
            --build-arg INSTALL_DEV=false \
            -t "${WEB_IMAGE}:local" .
          docker save "${WEB_IMAGE}:local" -o /tmp/web.tar

          ./crane push --insecure /tmp/web.tar "${REGISTRY}/${WEB_IMAGE}:${BRANCH_TAG}"
          ./crane push --insecure /tmp/web.tar "${REGISTRY}/${WEB_IMAGE}:${BRANCH_TAG}-${SHA_SHORT}"
          if [ "${GITHUB_REF_NAME}" = "main" ]; then
            ./crane push --insecure /tmp/web.tar "${REGISTRY}/${WEB_IMAGE}:latest"
          fi

          docker build \
            -f ./docker/Dockerfile \
            --target runtime-celery \
            --build-arg INSTALL_DEV=false \
            -t "${CELERY_IMAGE}:local" .
          docker save "${CELERY_IMAGE}:local" -o /tmp/celery.tar

          ./crane push --insecure /tmp/celery.tar "${REGISTRY}/${CELERY_IMAGE}:${BRANCH_TAG}"
          ./crane push --insecure /tmp/celery.tar "${REGISTRY}/${CELERY_IMAGE}:${BRANCH_TAG}-${SHA_SHORT}"
          if [ "${GITHUB_REF_NAME}" = "main" ]; then
            ./crane push --insecure /tmp/celery.tar "${REGISTRY}/${CELERY_IMAGE}:latest"
          fi

      - name: Image summary
        run: |
          REPO_OWNER="${GITHUB_REPOSITORY%%/*}"
          echo "Images pushed to ${REGISTRY_HOST}/${REPO_OWNER}/"

      - name: Telegram notify (build_push failed)
        if: failure()
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="❌ [mostovik-backend] build_push failed
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}
          registry=${REGISTRY_HOST}"

          curl -fsS -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"

      - name: Telegram notify (build_push success)
        if: success()
        env:
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail
          if [ -z "${TG_BOT_KEY:-}" ] || [ -z "${TG_CHANNEL:-}" ]; then
            echo "TG_BOT_KEY or TG_CHANNEL is not set; skip telegram notification"
            exit 0
          fi

          MSG="✅ [mostovik-backend] image build & push success
          branch=${GITHUB_REF_NAME}
          sha=${GITHUB_SHA}
          actor=${GITHUB_ACTOR}
          registry=${REGISTRY_HOST}
          commit=${COMMIT_MESSAGE}"

          curl -fsS -X POST "https://api.telegram.org/bot${TG_BOT_KEY}/sendMessage" \
            -d "chat_id=${TG_CHANNEL}" \
            --data-urlencode "text=${MSG}"