name: Build Hugo

on:
  push:
    branches: [ "main" ]

env:
  REGISTRY: tea.ahmza.com
  IMAGE_NAME: ${{ gitea.repository }}

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Login to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.repository_owner }}
          password: ${{ secrets.GITEATOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/arm64, linux/amd64
          push: true
          build-args: |
            BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
          tags: |
            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
          # Registry-backed build cache. The GitHub-hosted 'gha' cache is not
          # reachable from self-hosted Gitea runners, so store the cache as a
          # dedicated tag in the same registry instead.
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
  deploy:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Pre-flight - verify VPN prerequisites
        # NetBird brings up a WireGuard interface, which needs a TUN device and
        # NET_ADMIN inside the job container. Without them, `netbird up` hangs
        # ~50s and dies with a cryptic "DeadlineExceeded". Check up front so the
        # failure is obvious and points at the fix (runner config.yaml).
        run: |
          echo "::group::NetBird prerequisites"
          if [ -e /dev/net/tun ]; then
            echo "OK: /dev/net/tun present"
          else
            echo "::error title=Missing TUN device::/dev/net/tun not found. Add --device=/dev/net/tun to the runner's config.yaml container.options."
            exit 1
          fi
          if command -v capsh >/dev/null 2>&1; then
            capsh --print | grep -q 'cap_net_admin' \
              && echo "OK: NET_ADMIN present" \
              || echo "::warning title=NET_ADMIN missing::netbird up will likely time out (DeadlineExceeded) configuring wt0. Add --cap-add=NET_ADMIN to the runner's config.yaml container.options."
          else
            echo "note: capsh unavailable, skipping NET_ADMIN check"
          fi
          echo "::endgroup::"

      - name: Netbird Connect
        id: netbird
        timeout-minutes: 3
        uses: Alemiz112/netbird-connect@v1
        with:
          setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
          hostname: 'gitea-actions-blog'
          management-url: ${{ secrets.NETBIRD_URL }}

      - name: NetBird status
        # Surface the actual peer/route state in the log and hard-assert that
        # the management connection is up before attempting any deploys.
        run: |
          echo "::group::netbird status"
          sudo netbird status --detail || true
          echo "::endgroup::"
          sudo netbird status | grep -q 'Management: Connected' \
            && echo "NetBird management connected." \
            || { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }

      - name: Install kubectl
        uses: azure/setup-kubectl@v4
        with:
          version: 'v1.36.2'

      - name: Configure Kubernetes access
        env:
          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
          KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
        run: |
          set -euo pipefail

          if [ -z "${KUBE_TOKEN:-}" ]; then
            echo "::error::KUBE_TOKEN is empty"
            exit 1
          fi

          if [ -z "${KUBE_CA_B64:-}" ]; then
            echo "::error::KUBE_CA_B64 is empty"
            exit 1
          fi

          KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig"
          CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt"

          printf '%s' "$KUBE_CA_B64" \
            | base64 -d \
            > "$CA_PATH"

          kubectl config \
            --kubeconfig="$KUBECONFIG_PATH" \
            set-cluster talos-prod \
            --server=https://10.10.10.210:6443 \
            --tls-server-name=k8s-api.ahmza.com \
            --certificate-authority="$CA_PATH" \
            --embed-certs=true

          kubectl config \
            --kubeconfig="$KUBECONFIG_PATH" \
            set-credentials gitea-blog-deployer \
            --token="$KUBE_TOKEN"

          kubectl config \
            --kubeconfig="$KUBECONFIG_PATH" \
            set-context blog-deployer@talos-prod \
            --cluster=talos-prod \
            --user=gitea-blog-deployer \
            --namespace=blog-ahmza-com

          kubectl config \
            --kubeconfig="$KUBECONFIG_PATH" \
            use-context blog-deployer@talos-prod

          chmod 600 "$KUBECONFIG_PATH"

          echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"

          echo
          echo "Kubernetes configuration:"
          echo -n "  API server: "
          kubectl config \
            --kubeconfig="$KUBECONFIG_PATH" \
            view --minify \
            -o jsonpath='{.clusters[0].cluster.server}'
          echo

          echo -n "  Context:    "
          kubectl config \
            --kubeconfig="$KUBECONFIG_PATH" \
            current-context

          echo

          # Check that a bearer token really made it into the generated config
          # without printing the token itself.
          TOKEN_LENGTH="$(
            kubectl config \
              --kubeconfig="$KUBECONFIG_PATH" \
              view --raw --minify \
              -o jsonpath='{.users[0].user.token}' \
            | wc -c
          )"

          echo "  Token length: $TOKEN_LENGTH"

          if [ "$TOKEN_LENGTH" -lt 100 ]; then
            echo "::error::Generated kubeconfig does not contain a valid-looking token"
            exit 1
          fi

      - name: Verify Kubernetes access
        run: |
          set -euo pipefail

          echo "Testing authenticated API access..."
          kubectl -n blog-ahmza-com get deployment blog

          echo
          echo "Testing intended permissions..."

          if kubectl auth can-i patch deployments \
            -n blog-ahmza-com
          then
            echo "OK: deployment patch permitted"
          else
            echo "::error::Deployment patch unexpectedly denied"
            exit 1
          fi

          echo
          echo "Testing privilege boundary..."

          if kubectl auth can-i get secrets \
            -n blog-ahmza-com
          then
            echo "::error::CI account unexpectedly has Secret read access"
            exit 1
          else
            echo "OK: Secret read correctly denied"
          fi

      - name: Deploy to Kubernetes
        env:
          IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
        run: |
          set -euo pipefail

          echo "Deploying image:"
          echo "  $IMAGE"

          kubectl -n blog-ahmza-com \
            set image deployment/blog \
            blog="$IMAGE"

          if ! kubectl -n blog-ahmza-com \
            rollout status deployment/blog \
            --timeout=5m
          then
            echo "::error::New deployment failed. Rolling back."

            kubectl -n blog-ahmza-com \
              rollout undo deployment/blog

            kubectl -n blog-ahmza-com \
              rollout status deployment/blog \
              --timeout=5m

            exit 1
          fi

          echo
          echo "Deployment complete:"
          kubectl -n blog-ahmza-com get pods -o wide

          echo
          echo "Running image:"
          kubectl -n blog-ahmza-com \
            get deployment blog \
            -o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
          echo

      - name: NetBird diagnostics & disconnect
        # Runs even on failure: captures final state for debugging and tears the
        # peer down so stale 'gitea-actions-blog' peers don't pile up.
        if: always()
        run: |
          echo "::group::final netbird status"
          sudo netbird status --detail || echo "netbird unavailable"
          echo "::endgroup::"
          sudo netbird down || true