name: Uforia Prod Deploy

on:
  push:
    branches:
      - master
      - main
  workflow_dispatch:

env:
  GCP_REGION: europe-north1
  GCP_PROJECT_ID: polynomial-uforia
  IMAGE_TAG: main-${{ github.sha }}
  IAC_CONFIG_REPO: Polynomial-Protocol/iac-config
  UFORIA_BASE_URL: http://uforia.polynomial.fi
  UFORIA_RESOLVE_IP: 34.54.59.248

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - uses: astral-sh/setup-uv@v6
      - run: uv sync --frozen --extra dev
      - run: npm ci
      - run: uv run pytest -q
      - run: npm run typecheck:web
      - run: npm run test:web

  build-and-push:
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_ARTIFACT_PUSH_SA }}
      - uses: google-github-actions/setup-gcloud@v2
      - run: gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet
      - shell: bash
        run: |
          set -euo pipefail

          build_and_push() {
            local name="$1"
            local dockerfile="$2"
            local repository="${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/uforia/${name}"
            local image="${repository}:${IMAGE_TAG}"

            if gcloud artifacts docker tags list "${repository}" \
              --filter="tag:${IMAGE_TAG}" \
              --format="value(tag)" \
              --limit=1 | grep -qx "${IMAGE_TAG}"; then
              echo "Image already exists, skipping push: ${image}"
              return 0
            fi

            docker buildx build \
              --platform linux/amd64 \
              -f "${dockerfile}" \
              -t "${image}" \
              --push \
              .
          }

          build_and_push web Dockerfile.web
          build_and_push api Dockerfile.api
          build_and_push python Dockerfile.worker

  update-iac:
    runs-on: ubuntu-latest
    needs: build-and-push
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: ${{ env.IAC_CONFIG_REPO }}
          path: iac-config
          token: ${{ secrets.IAC_CONFIG_PUSH_TOKEN || secrets.GH_PAT }}
      - run: python3 ops/update_iac_uforia.py --iac-root iac-config --tag ${IMAGE_TAG}
      - run: |
          cd iac-config
          git config user.name "uforia-bot"
          git config user.email "uforia-bot@polynomial.fi"
          git add services/uforia/prod/kustomization.yaml
          git commit -m "Deploy uforia ${IMAGE_TAG}" || exit 0
          git push

  smoke:
    runs-on: ubuntu-latest
    needs: update-iac
    env:
      SLACK_DEPLOY_WEBHOOK: ${{ secrets.SLACK_DEPLOY_WEBHOOK }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - run: npm install --no-save playwright@1.54.1
      - run: npx playwright install --with-deps chromium
      - run: node ops/smoke-prod.mjs
      - if: failure() && env.SLACK_DEPLOY_WEBHOOK != ''
        run: |
          MESSAGE="{\"text\":\"Uforia prod deploy smoke test failed for ${IMAGE_TAG}\"}"
          curl -X POST -H 'Content-type: application/json' \
            --data "${MESSAGE}" \
            "${SLACK_DEPLOY_WEBHOOK}"
