name: CI/CD Pipeline

on:
  push:
    branches:
      - main
      - develop
      - dev
  pull_request:
    branches:
      - main
      - develop
      - dev

env:
  PYTHON_VERSION: "3.11"
  REGISTRY_HOST: "registry.dev.nii-ecos.ru"
  REGISTRY_NAMESPACE: "${{ github.repository_owner }}"
  WEB_IMAGE: "state-corp-backend-web"
  CELERY_IMAGE: "state-corp-backend-celery"

jobs:
  lint:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout code
        run: |
          set -euo pipefail
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          PROJECT_PYTHON_VERSION="$(cat .python-version 2>/dev/null || printf '%s' "${PYTHON_VERSION}")"
          PYTHON_BIN="$(./scripts/ensure-ci-python.sh "${PROJECT_PYTHON_VERSION}")"
          printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          . ./.ci-python-env
          "${PYTHON_BIN}" -m venv .venv
          . .venv/bin/activate
          python -m pip install --upgrade pip uv
          uv sync \
            --dev \
            --frozen \
            --active \
            --python "${PYTHON_BIN}" \
            --no-managed-python \
            --no-python-downloads

      - name: Run Ruff linting
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff check src tests scripts

      - name: Run Ruff formatting check
        run: |
          set -euo pipefail
          . .venv/bin/activate
          ruff format src tests scripts --check

  test:
    name: Run Tests
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout code
        run: |
          set -euo pipefail
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Install Python and uv
        run: |
          set -euo pipefail
          PROJECT_PYTHON_VERSION="$(cat .python-version 2>/dev/null || printf '%s' "${PYTHON_VERSION}")"
          PYTHON_BIN="$(./scripts/ensure-ci-python.sh "${PROJECT_PYTHON_VERSION}")"
          printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env

      - name: Create virtual environment and install dependencies
        run: |
          set -euo pipefail
          . ./.ci-python-env
          "${PYTHON_BIN}" -m venv .venv
          . .venv/bin/activate
          python -m pip install --upgrade pip uv
          uv sync \
            --dev \
            --frozen \
            --active \
            --python "${PYTHON_BIN}" \
            --no-managed-python \
            --no-python-downloads

      - name: Run pytest suite
        env:
          DJANGO_SETTINGS_MODULE: settings.test
          SECRET_KEY: test-secret-key-for-ci
        run: |
          set -euo pipefail
          export PYTHONPATH="${PWD}/src:${PYTHONPATH:-}"
          .venv/bin/python -m pytest tests -q

  build_push:
    name: Build and Push Dev Images
    runs-on: ubuntu-latest
    timeout-minutes: 45
    needs: [lint, test]
    if: github.event_name == 'push' && github.ref == 'refs/heads/dev' && !contains(github.event.head_commit.message, '#no_image')

    steps:
      - name: Checkout code
        run: |
          set -euo pipefail
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Build and push images
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_PASSWORD:-}" ]; then
            echo "Registry credentials are not configured" >&2
            exit 1
          fi

          SHA_SHORT="$(printf '%s' "${GITHUB_SHA}" | cut -c1-7)"
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          REGISTRY="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}"
          WEB_REF="${REGISTRY}/${WEB_IMAGE}"
          CELERY_REF="${REGISTRY}/${CELERY_IMAGE}"

          echo "${REGISTRY_PASSWORD}" \
            | docker login "${REGISTRY_HOST}" \
              -u "${REGISTRY_USER}" \
              --password-stdin

          if ! docker buildx inspect state-corp-builder >/dev/null 2>&1; then
            docker buildx create --name state-corp-builder --use
          else
            docker buildx use state-corp-builder
          fi
          docker buildx inspect --bootstrap

          docker buildx build \
            -f ./docker/Dockerfile \
            --target runtime-web \
            --build-arg INSTALL_DEV=false \
            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
            --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
            --label "org.opencontainers.image.created=${BUILD_TIME}" \
            --tag "${WEB_REF}:dev-${SHA_SHORT}" \
            --tag "${WEB_REF}:dev" \
            --push \
            .

          docker buildx build \
            -f ./docker/Dockerfile \
            --target runtime-celery \
            --build-arg INSTALL_DEV=false \
            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
            --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
            --label "org.opencontainers.image.created=${BUILD_TIME}" \
            --tag "${CELERY_REF}:dev-${SHA_SHORT}" \
            --tag "${CELERY_REF}:dev" \
            --push \
            .

  deploy_dev:
    name: Deploy Dev via Compose
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: [build_push]
    if: needs.build_push.result == 'success'

    steps:
      - name: Checkout code
        run: |
          set -euo pipefail
          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
          git clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
          git checkout "${GITHUB_SHA}"

      - name: Deploy prebuilt images via SSH
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          REGISTRY_HOST: ${{ secrets.REGISTRY_HOST }}
          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail

          if [ "${GITHUB_REF}" != "refs/heads/dev" ]; then
            echo "Skip dev deploy for ${GITHUB_REF}"
            exit 0
          fi

          case "${HEAD_COMMIT_MESSAGE:-}" in
            *"#no_deploy"* | *"#no_image"*)
              echo "Skip dev deploy because commit message disables deploy or image build"
              exit 0
              ;;
          esac

          short_sha="$(printf '%s' "${GITHUB_SHA}" | cut -c1-7)"
          image_tag="dev-${short_sha}"
          mkdir -p ~/.ssh
          printf '%s' "${DEPLOY_SSH_KEY}" | base64 -d > ~/.ssh/ecos_deploy_key
          chmod 0600 ~/.ssh/ecos_deploy_key
          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
          tmp_current="$(mktemp)"
          ssh -i ~/.ssh/ecos_deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" 'cat /opt/ecos-dev/releases/current.env' > "${tmp_current}"
          grep -v '^STATE_CORP_BACKEND_' "${tmp_current}" > "${tmp_current}.new"
          cat >> "${tmp_current}.new" <<EOF
          STATE_CORP_BACKEND_WEB_IMAGE=${REGISTRY_HOST}/avm/state-corp-backend-web:${image_tag}
          STATE_CORP_BACKEND_CELERY_IMAGE=${REGISTRY_HOST}/avm/state-corp-backend-celery:${image_tag}
          EOF
          scp -i ~/.ssh/ecos_deploy_key "${tmp_current}.new" "${DEPLOY_USER}@${DEPLOY_HOST}:/tmp/current.env"
          ssh -i ~/.ssh/ecos_deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" 'cat /tmp/current.env > /opt/ecos-dev/releases/current.env && rm -f /tmp/current.env && /opt/ecos-dev/deploy.sh state-corp-backend'