name: delivery

on:
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: production-delivery
  cancel-in-progress: false

env:
  REGISTRY: git.kandrusyak.ru
  IMAGE: git.kandrusyak.ru/admin/kandrusyak-bot

jobs:
  quality:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.12"]

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-common.txt -r requirements-dev.txt
      - name: Lint
        run: python -m ruff check .
      - name: Test with coverage
        run: |
          python -m coverage run -m unittest discover -v
          python -m coverage report

  build-and-push:
    needs: quality
    runs-on: docker-build
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v4
      - name: Log in to the container registry
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          test -n "$REGISTRY_TOKEN"
          printf '%s' "$REGISTRY_TOKEN" |
            docker login "$REGISTRY" --username admin --password-stdin
      - name: Build the cloud image
        run: |
          docker build \
            --target yandex \
            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
            --tag "$IMAGE:$GITHUB_SHA" \
            --tag "$IMAGE:latest" \
            .
      - name: Push immutable and latest tags
        run: |
          docker push "$IMAGE:$GITHUB_SHA"
          docker push "$IMAGE:latest"
      - name: Log out from the container registry
        if: ${{ always() }}
        run: docker logout "$REGISTRY" || true

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Configure the deployment key
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -d -m 700 "$HOME/.ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/deploy_key" "$HOME/.ssh/known_hosts"
      - name: Deploy the published commit
        run: |
          ssh \
            -i "$HOME/.ssh/deploy_key" \
            -o IdentitiesOnly=yes \
            -o BatchMode=yes \
            -o StrictHostKeyChecking=yes \
            -p 22 \
            kandrusyak-bot@hole.kandrusyak.ru \
            "deploy $GITHUB_SHA"
      - name: Remove the deployment key
        if: ${{ always() }}
        run: rm -f "$HOME/.ssh/deploy_key"