# Deploy: build → push → nomad job run, on every push to main.
#
# Runner requirements (verify on the Forgejo VPS):
#   - job container gets the docker socket (runner config must allow
#     valid_volumes for /var/run/docker.sock — see README §deploy notes), or
#     switch `runs-on` to the host label and drop the container/socket bits;
#   - Docker Hub reachable (nomad CLI is extracted from hashicorp/nomad:1.9 —
#     releases.hashicorp.com is blocked from this network).
#
# Repo secrets (Settings → Secrets):
#   REGISTRY_TOKEN   forgejo token, write:package scope (docker login)
#   NOMAD_TOKEN      CI ACL token from deploy/nomad/README.md §5
#   NOMAD_CACERT     contents of nomad-ca.crt from README §3
# Repo variables (Settings → Variables):
#   NOMAD_ADDR_HOST  services VPS public IP or DNS name (API :4646)
# Registry location is baked below (resolved): p2gnl.mu-dungeon.xyz/admin-git

name: deploy

on:
  push:
    branches: [main]

env:
  REGISTRY_HOST: p2gnl.mu-dungeon.xyz
  REGISTRY_OWNER: admin-git

jobs:
  build-and-deploy:
    runs-on: docker
    container:
      image: docker:28-cli
      options: --volume /var/run/docker.sock:/var/run/docker.sock
    steps:
      - name: Checkout
        run: |
          apk add --no-cache git
          git init -q .
          git remote add origin ${{ gitea.server_url }}/${{ gitea.repository }}.git
          git fetch --depth 1 origin ${{ gitea.sha }}
          git checkout -q FETCH_HEAD

      - name: Extract nomad CLI (official image; CDN is blocked here)
        run: |
          docker create --name nomad-extract hashicorp/nomad:1.9 >/dev/null
          docker cp nomad-extract:/bin/nomad /usr/local/bin/nomad
          docker rm nomad-extract >/dev/null
          nomad version

      - name: Registry login
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | \
            docker login "$REGISTRY_HOST" -u "$REGISTRY_OWNER" --password-stdin

      - name: Build & push images (SHA tag)
        run: |
          set -e
          TAG="${GITEA_SHA}"
          for name in api worker-extract worker-analyze worker-prescreen worker-billing worker-notify; do
            image="$REGISTRY_HOST/$REGISTRY_OWNER/contract-check-$name"
            docker build -f "srv/$name/Dockerfile" -t "$image:$TAG" .
            docker push "$image:$TAG"
          done

      - name: Deploy to Nomad
        run: |
          mkdir -p /tmp/nomad-tls
          echo "${{ secrets.NOMAD_CACERT }}" > /tmp/nomad-tls/ca.crt
          export IMAGE_TAG="${GITEA_SHA}"
          export NOMAD_ADDR="https://${{ vars.NOMAD_ADDR_HOST }}:4646"
          export NOMAD_CACERT=/tmp/nomad-tls/ca.crt
          export NOMAD_TOKEN="${{ secrets.NOMAD_TOKEN }}"
          nomad job run deploy/nomad/contract-check.nomad.hcl
          # the CLI follows the deployment and exits non-zero if health
          # checks fail — auto_revert then rolls the job back server-side.