name: Build and Push Docs Portal

on:
  push:
    branches:
      - main
    paths:
      - 'workloads/docs-portal/docs/**'
      - 'workloads/docs-portal/mkdocs.yml'
      - 'workloads/docs-portal/requirements.txt'
      - 'workloads/docs-portal/Dockerfile'
      - '.gitea/workflows/deploy-docs.yaml'

permissions:
  contents: write
  packages: write

jobs:
  build:
    name: Construir y publicar Docs Portal
    runs-on: ubuntu-latest
    timeout-minutes: 20

    env:
      APP_DIR: workloads/docs-portal
      MANIFEST_FILE: workloads/docs-portal/deployment.yaml
      IMAGE_NAME: gitea.cruzcloud.net/devops/docs-portal

    steps:
      - name: Checkout del código
        uses: actions/checkout@v3
        with:
          fetch-depth: 1
          persist-credentials: true

      - name: Definir versión
        id: vars
        shell: bash
        run: |
          set -euo pipefail
          echo "VERSION=v1.0.${{ github.run_number }}" >> "$GITHUB_OUTPUT"

      - name: Validar secretos del Registry
        shell: bash
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          test -n "${REGISTRY_USER}" || {
            echo "ERROR: REGISTRY_USER no está configurado."
            exit 1
          }
          test -n "${REGISTRY_PASSWORD}" || {
            echo "ERROR: REGISTRY_PASSWORD no está configurado."
            exit 1
          }

      - name: Login en Gitea Registry
        uses: docker/login-action@v2
        with:
          registry: gitea.cruzcloud.net
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}
          logout: true

      # mkdocs build --strict corre dentro del propio Dockerfile (stage de
      # build), así que un nav/link roto rompe este paso antes de publicar.
      - name: Construir y subir imagen
        uses: docker/build-push-action@v4
        with:
          context: workloads/docs-portal/
          file: workloads/docs-portal/Dockerfile
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.VERSION }}
            ${{ env.IMAGE_NAME }}:latest

      - name: Verificar promoción segura
        id: promotion
        shell: bash
        run: |
          set -euo pipefail

          git fetch origin main

          CURRENT_SHA="${{ github.sha }}"
          REMOTE_SHA="$(git rev-parse origin/main)"

          if [ "${CURRENT_SHA}" = "${REMOTE_SHA}" ]; then
            echo "promote=true" >> "$GITHUB_OUTPUT"
          else
            echo "promote=false" >> "$GITHUB_OUTPUT"
            echo "Hay un commit más reciente; no se actualizará el manifiesto."
          fi

      - name: Actualizar manifiesto GitOps
        if: steps.promotion.outputs.promote == 'true'
        shell: bash
        run: |
          set -euo pipefail

          VERSION="${{ steps.vars.outputs.VERSION }}"

          git config user.name "gitea-actions"
          git config user.email "gitea-actions@cruzcloud.net"

          git fetch origin main
          git checkout -B main origin/main

          sed -i -E \
            "s|(image: ${IMAGE_NAME}:).*|\1${VERSION}|g" \
            "${MANIFEST_FILE}"

          git add "${MANIFEST_FILE}"

          if git diff --cached --quiet; then
            echo "El manifiesto ya apunta a ${VERSION}."
            exit 0
          fi

          git commit \
            -m "chore(gitops): deploy Docs Portal ${VERSION} [skip ci]"

          git push origin HEAD:main