name: TheCr3w Docker Build and Deploy Pipeline

on:
  push:
    branches: [ main ]
    tags: [ 'v*.*.*' ]

jobs:
  build-and-package:
    runs-on: docker
    steps:
      - name: Checkout Source Code
        uses: actions/checkout@v4

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore and Build
        run: dotnet build TheCr3w.slnx -c Release

      - name: Run Unit and Security Tests
        run: dotnet test TheCr3w.slnx -c Release --no-build

      - name: Log in to Forgejo OCI Container Registry
        run: echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login git.thecr3wnet.com -u "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin

      - name: Build and Push OCI Image
        id: docker_build
        run: |
          IMAGE_TAG="git.thecr3wnet.com/thecr3w/backend:${{ github.sha }}"
          docker build -t "$IMAGE_TAG" -f infrastructure/docker/Dockerfile.backend .
          docker push "$IMAGE_TAG"
          
          # Pobranie niezmiennego skrótu (Immutable Digest)
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_TAG" | cut -d'@' -f2)
          echo "IMMUTABLE_DIGEST=$DIGEST" >> $GITHUB_ENV
          echo "Wygenerowany niezmienny digest OCI: $DIGEST"

      - name: Create and Sign Deployment Manifest
        id: create_manifest
        env:
          SIGNING_KEY_HEX: ${{ secrets.ED25519_SIGNING_PRIVATE_KEY }}
        run: |
          MANIFEST_ID=$(uuidgen || cat /proc/sys/kernel/random/uuid)
          echo "Tworzenie manifestu wdrożeniowego $MANIFEST_ID..."
          
          # Generowanie kanonicznego JSON manifestu
          cat <<EOF > manifest.json
          {
            "manifest_id": "$MANIFEST_ID",
            "project": "thecr3w-backend",
            "environment": "production",
            "service_name": "backend",
            "image": "git.thecr3wnet.com/thecr3w/backend",
            "immutable_digest": "$IMMUTABLE_DIGEST",
            "config_hash": "${{ github.sha }}",
            "secrets_references": ["ConnectionStrings__DefaultConnection", "Keycloak__Authority"],
            "required_migrations": ["01-init-schema"],
            "healthcheck": {
              "path": "/health",
              "port": 5000,
              "interval_seconds": 10,
              "timeout_seconds": 5,
              "retries": 3
            },
            "rollback_strategy": {
              "mode": "automatic_on_health_failure",
              "target_immutable_digest": "none"
            },
            "created_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
            "created_by": "forgejo-ci-${{ github.actor }}"
          }
          EOF

      - name: Submit Manifest to Deployment Control API
        run: |
          curl -f -X POST "https://app.thecr3wnet.com/control/api/v1/deployments/manifests" \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer ${{ secrets.THECR3W_API_TOKEN }}" \
            -d @manifest.json