name: Deploy AWS Batch

on:
  workflow_dispatch:
    inputs:
      action:
        description: 'Action to perform'
        required: true
        type: choice
        options:
          - plan
          - apply
          - destroy
      job_name:
        description: 'Trigger a specific job (only for action=trigger)'
        required: false
        default: ''
  push:
    branches:
      - main
    paths:
      - 'deploy/aws-batch/**'

env:
  AWS_REGION: {{ region }}
  TF_WORKING_DIR: deploy/aws-batch

jobs:
  terraform:
    name: Terraform ${{ '{{' }} github.event.inputs.action || 'plan' {{ '}}' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ${{ '{{' }} env.TF_WORKING_DIR {{ '}}' }}
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ '{{' }} secrets.AWS_ACCESS_KEY_ID {{ '}}' }}
          aws-secret-access-key: ${{ '{{' }} secrets.AWS_SECRET_ACCESS_KEY {{ '}}' }}
          aws-region: ${{ '{{' }} env.AWS_REGION {{ '}}' }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        if: ${{ '{{' }} github.event.inputs.action != 'destroy' {{ '}}' }}
        run: terraform plan -out=tfplan

      - name: Terraform Apply
        if: ${{ '{{' }} github.event.inputs.action == 'apply' || (github.event_name == 'push' && github.ref == 'refs/heads/main') {{ '}}' }}
        run: terraform apply -auto-approve tfplan

      - name: Terraform Destroy
        if: ${{ '{{' }} github.event.inputs.action == 'destroy' {{ '}}' }}
        run: terraform destroy -auto-approve

  trigger-job:
    name: Trigger Batch Job
    runs-on: ubuntu-latest
    if: ${{ '{{' }} github.event.inputs.job_name != '' {{ '}}' }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ '{{' }} secrets.AWS_ACCESS_KEY_ID {{ '}}' }}
          aws-secret-access-key: ${{ '{{' }} secrets.AWS_SECRET_ACCESS_KEY {{ '}}' }}
          aws-region: ${{ '{{' }} env.AWS_REGION {{ '}}' }}

      - name: Submit Batch Job
        run: |
          JOB_NAME="${{ '{{' }} github.event.inputs.job_name {{ '}}' }}"
          aws batch submit-job \
            --job-name "{{ project_name }}-${JOB_NAME}-manual" \
            --job-queue "{{ project_name }}-job-queue" \
            --job-definition "{{ project_name }}-${JOB_NAME}"

          echo "Job submitted: ${JOB_NAME}"

  status:
    name: Batch Status
    runs-on: ubuntu-latest
    if: ${{ '{{' }} github.event.inputs.action == 'status' {{ '}}' }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ '{{' }} secrets.AWS_ACCESS_KEY_ID {{ '}}' }}
          aws-secret-access-key: ${{ '{{' }} secrets.AWS_SECRET_ACCESS_KEY {{ '}}' }}
          aws-region: ${{ '{{' }} env.AWS_REGION {{ '}}' }}

      - name: Show job status
        run: |
          echo "## AWS Batch Status — {{ project_name }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          {% for job in jobs %}
          echo "### {{ job.name }}" >> $GITHUB_STEP_SUMMARY
          aws batch describe-jobs \
            --jobs $(aws batch list-jobs --job-queue "{{ project_name }}-job-queue" --job-status RUNNING --query 'jobSummaryList[?jobName==`{{ project_name }}-{{ job.name }}`].jobId' --output text) \
            --query 'jobs[].{Name:jobName,Status:status,Created:createdAt}' \
            --output table >> $GITHUB_STEP_SUMMARY 2>/dev/null || echo "No running jobs" >> $GITHUB_STEP_SUMMARY
          {% endfor %}
