version: v2beta1
name: specwright

vars:
  DEVSPACE_USERNAME:
    source: env
    default: ${USER}
  DOPPLER_CONFIG:
    source: none
    default: dev_personal
  DOCR_REGISTRY:
    source: none
    default: registry.digitalocean.com
  BASE_DOMAIN:
    source: none
    default: specwright.gernerventures.com

localRegistry:
  enabled: false  # Push to DOCR directly (local registry can't rewrite Helm-templated images)

images:
  specwright:
    image: ${DOCR_REGISTRY}/gv-shared/specwright
    tags:
      - dev-${DEVSPACE_USERNAME}-${DEVSPACE_GIT_COMMIT}
    dockerfile: ./Dockerfile.dev
    context: ./
    docker: {}

deployments:
  specwright:
    helm:
      chart:
        path: ./chart/specwright/
      releaseName: specwright-dev-${DEVSPACE_USERNAME}
      valuesFiles:
        - ./chart/specwright/values-dev.yaml
      values:
        image:
          registry: ${DOCR_REGISTRY}
          repository: gv-shared/specwright
          tag: dev-${DEVSPACE_USERNAME}-${DEVSPACE_GIT_COMMIT}
        ingress:
          hostname: ${DEVSPACE_USERNAME}.${BASE_DOMAIN}

dev:
  specwright:
    labelSelector:
      app.kubernetes.io/instance: specwright-dev-${DEVSPACE_USERNAME}
    command:
      - uvicorn
      - specwright.main:app
      - --host
      - "0.0.0.0"
      - --port
      - "3000"
      - --reload
      - --reload-dir
      - /app/src
    sync:
      - path: ./src:/app/src
        excludePaths:
          - "**/__pycache__"
          - "**/*.pyc"
      - path: ./templates:/app/templates
      - path: ./static:/app/static
    ports:
      - port: "3000:3000"
    patches:
      # Allow writable filesystem for dev (editable install)
      - op: replace
        path: spec.containers[0].securityContext
        value:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false
          capabilities:
            drop:
              - ALL
      # Run as root for pip editable install writes
      - op: replace
        path: spec.securityContext
        value:
          runAsNonRoot: false
          runAsUser: 0
          runAsGroup: 0
          fsGroup: 0

pipelines:
  dev: |-
    run_pipelines sync-secrets
    ensure_pull_secrets --all
    build_images --all
    create_deployments --all
    start_dev --all

  deploy: |-
    run_pipelines sync-secrets
    ensure_pull_secrets --all
    build_images --all
    create_deployments --all

  build: |-
    ensure_pull_secrets --all
    build_images --all

  purge: |-
    stop_dev --all
    purge_deployments --all

  sync-secrets: |-
    echo "Syncing Doppler secrets (project: specwright, config: ${DOPPLER_CONFIG})..."
    doppler secrets download \
      --project specwright \
      --config ${DOPPLER_CONFIG} \
      --no-file --format env-no-quotes \
    | kubectl create secret generic specwright-dev-secrets \
      --namespace ${DEVSPACE_NAMESPACE} \
      --from-env-file=/dev/stdin \
      --dry-run=client -o yaml \
    | kubectl apply -f -
    echo "Secrets synced to namespace ${DEVSPACE_NAMESPACE}"

commands:
  sync-secrets:
    command: devspace run-pipeline sync-secrets
    description: Sync Doppler secrets to the dev namespace

  logs:
    command: kubectl logs -f -l app.kubernetes.io/instance=specwright-dev-${DEVSPACE_USERNAME} --namespace ${DEVSPACE_NAMESPACE}
    description: Tail logs from the dev pod

  sync-trigger:
    command: |-
      kubectl exec -it \
        $(kubectl get pod -l app.kubernetes.io/instance=specwright-dev-${DEVSPACE_USERNAME} -n ${DEVSPACE_NAMESPACE} -o jsonpath='{.items[0].metadata.name}') \
        -n ${DEVSPACE_NAMESPACE} -- \
        python -m specwright.cron.sync_status
    description: Manually trigger reverse sync cron job

pullSecrets:
  docr-registry:
    registry: ${DOCR_REGISTRY}
