name: Dev Build & Deploy Portal

on:
  push:
    branches:
      - developer

# Variáveis necessárias no Gitea (Settings → Variables):
#   DEV_NUXT_KEYCLOAK_URL          ex: https://keycloakprod.modumfiscal.com.br
#   DEV_NUXT_KEYCLOAK_REALM        ex: modumfiscal-portal-dev
#   DEV_NUXT_KEYCLOAK_CLIENT_ID    ex: portal-modumfiscal-bff
#   DEV_NUXT_CORE_API_URL          ex: https://sistema.modumfiscal.com.br
#   DEV_NUXT_REDIS_URL             ex: redis://portal-redis:6379
#
# Secrets necessários (Settings → Secrets):
#   REGISTRY_USER
#   REGISTRY_PASSWORD
#   NUXT_KEYCLOAK_CLIENT_SECRET
#   NUXT_COOKIE_SECRET             gere com: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

jobs:
  build-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Define version
        id: version
        run: |
          VERSION=$(date +'%Y.%m.%d.%H%M')
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Login registry
        env:
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
        run: |
          echo "$REGISTRY_PASSWORD" | docker login git.modumsolucao.com.br \
            -u "$REGISTRY_USER" \
            --password-stdin

      - name: Build Docker image
        run: |
          docker build \
            --memory=3g \
            -t git.modumsolucao.com.br/modumsolucao/portal-modumfiscal-web:latest \
            -t git.modumsolucao.com.br/modumsolucao/portal-modumfiscal-web:${{ steps.version.outputs.version }} \
            .

      - name: Push image
        run: |
          docker push git.modumsolucao.com.br/modumsolucao/portal-modumfiscal-web:latest
          docker push git.modumsolucao.com.br/modumsolucao/portal-modumfiscal-web:${{ steps.version.outputs.version }}

      - name: Deploy DEV
        env:
          NUXT_KEYCLOAK_URL: ${{ vars.DEV_NUXT_KEYCLOAK_URL }}
          NUXT_KEYCLOAK_REALM: ${{ vars.DEV_NUXT_KEYCLOAK_REALM }}
          NUXT_KEYCLOAK_CLIENT_ID: ${{ vars.DEV_NUXT_KEYCLOAK_CLIENT_ID }}
          NUXT_KEYCLOAK_CLIENT_SECRET: ${{ secrets.NUXT_KEYCLOAK_CLIENT_SECRET }}
          NUXT_CORE_API_URL: ${{ vars.DEV_NUXT_CORE_API_URL }}
          NUXT_REDIS_URL: ${{ vars.DEV_NUXT_REDIS_URL }}
          NUXT_COOKIE_SECRET: ${{ secrets.NUXT_COOKIE_SECRET }}
          IMAGE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          docker service update \
            --image git.modumsolucao.com.br/modumsolucao/portal-modumfiscal-web:$IMAGE_VERSION \
            --env-add NUXT_KEYCLOAK_URL="$NUXT_KEYCLOAK_URL" \
            --env-add NUXT_KEYCLOAK_REALM="$NUXT_KEYCLOAK_REALM" \
            --env-add NUXT_KEYCLOAK_CLIENT_ID="$NUXT_KEYCLOAK_CLIENT_ID" \
            --env-add NUXT_KEYCLOAK_CLIENT_SECRET="$NUXT_KEYCLOAK_CLIENT_SECRET" \
            --env-add NUXT_CORE_API_URL="$NUXT_CORE_API_URL" \
            --env-add NUXT_REDIS_URL="$NUXT_REDIS_URL" \
            --env-add NUXT_COOKIE_SECRET="$NUXT_COOKIE_SECRET" \
            --with-registry-auth \
            app_portal-modumfiscal-web

      - name: Cleanup old images
        run: |
          IMAGES_TO_DELETE=$(docker images "git.modumsolucao.com.br/modumsolucao/portal-modumfiscal-web" --format "{{.ID}}" | tail -n +3)
          if [ -n "$IMAGES_TO_DELETE" ]; then
            echo "$IMAGES_TO_DELETE" | xargs -I {} docker rmi -f {} || true
          fi
          docker image prune -f