# Deploy: build → push → nomad job run, on every push to master.
#
# Runner requirements (Forgejo VPS, via the docker-compose stack there):
#   - DinD daemon also listens on unix:///var/run/docker.sock (so the job's
#     docker:28-cli container can reach it via -v /var/run/docker.sock);
#   - runner config valid_volumes allows '**' (the job mounts that socket).
# nomad CLI is NOT extracted into the job container — the binary is
# glibc-dynamically-linked and won't exec in Alpine; instead the Deploy step
# runs `nomad` inside the hashicorp/nomad:1.9 image (which has the loader).
#
# Repo secrets (Settings → Secrets):
#   REGISTRY_TOKEN   forgejo token, write:package scope (docker login)
#   NOMAD_TOKEN      CI ACL token from deploy/nomad/README.md §5
#   NOMAD_CACERT     contents of nomad-ca.crt from README §3
# Repo variables (Settings → Variables):
#   NOMAD_ADDR_HOST  services VPS public IP or DNS name (API :4646)
# Registry location is baked below (resolved): p2gnl.mu-dungeon.xyz/admin-git

name: deploy

on:
  push:
    branches: [master]

env:
  REGISTRY_HOST: p2gnl.mu-dungeon.xyz
  REGISTRY_OWNER: admin-git

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    container:
      image: docker:28-cli
      options: --volume /var/run/docker.sock:/var/run/docker.sock
    steps:
      - name: Checkout
        run: |
          apk add --no-cache git
          git init -q .
          git remote add origin ${{ github.server_url }}/${{ github.repository }}.git
          git fetch --depth 1 origin ${{ github.sha }}
          git checkout -q FETCH_HEAD

      - name: Registry login
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | \
            docker login "$REGISTRY_HOST" -u "$REGISTRY_OWNER" --password-stdin

      - name: Build & push images (SHA tag)
        run: |
          set -e
          TAG="${{ github.sha }}"
          for name in api worker-extract worker-analyze worker-prescreen worker-billing worker-notify; do
            image="$REGISTRY_HOST/$REGISTRY_OWNER/contract-check-$name"
            docker build -f "srv/$name/Dockerfile" -t "$image:$TAG" .
            docker push "$image:$TAG"
          done

      - name: Deploy to Nomad
        # Run the nomad CLI inside its own image — the binary is
        # glibc-dynamically-linked (PT_INTERP = ld-linux-x86-64.so.2), so it
        # won't exec in the Alpine-based docker:28-cli container. The image
        # has the loader; mount the workspace so the job file + CA cert are
        # visible at the same paths.
        run: |
          mkdir -p .ci-tls
          printf '%s\n' "${{ secrets.NOMAD_CACERT }}" > .ci-tls/ca.crt
          docker run --rm \
            -v "$PWD:$PWD" -w "$PWD" \
            -e IMAGE_TAG="${{ github.sha }}" \
            -e NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646" \
            -e NOMAD_CACERT="$PWD/.ci-tls/ca.crt" \
            -e NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}" \
            --entrypoint /bin/nomad \
            hashicorp/nomad:1.9 job run deploy/nomad/contract-check.nomad.hcl
          rm -rf .ci-tls