name: CD

on:
  workflow_run:
    workflows:
      - CI
    types:
      - completed
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

concurrency:
  group: cd-main
  cancel-in-progress: false

jobs:
  check-secrets:
    name: Check deploy prerequisites
    runs-on: ubuntu-latest
    outputs:
      eligible_event: ${{ steps.check.outputs.eligible_event }}
      secrets_ok: ${{ steps.check.outputs.secrets_ok }}
      db_secret_ok: ${{ steps.check.outputs.db_secret_ok }}

    steps:
      - name: Evaluate trigger and required secrets
        id: check
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          GCP_SERVICE_ACCOUNT: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: |
          eligible_event=false
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            eligible_event=true
          elif [[ "${{ github.event_name }}" == "workflow_run" && "${{ github.event.workflow_run.conclusion }}" == "success" ]]; then
            eligible_event=true
          fi

          secrets_ok=false
          if [[ -n "$GCP_PROJECT_ID" && -n "$GCP_WORKLOAD_IDENTITY_PROVIDER" && -n "$GCP_SERVICE_ACCOUNT" ]]; then
            secrets_ok=true
          fi

          db_secret_ok=false
          if [[ -n "$DATABASE_URL" ]]; then
            db_secret_ok=true
          fi

          echo "eligible_event=$eligible_event" >> "$GITHUB_OUTPUT"
          echo "secrets_ok=$secrets_ok" >> "$GITHUB_OUTPUT"
          echo "db_secret_ok=$db_secret_ok" >> "$GITHUB_OUTPUT"

  deploy:
    name: Deploy Cloud Run
    runs-on: ubuntu-latest
    needs: check-secrets
    timeout-minutes: 30
    if: ${{ needs.check-secrets.outputs.eligible_event == 'true' && needs.check-secrets.outputs.secrets_ok == 'true' }}

    steps:
      - name: Checkout deployment ref
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Setup Bun
        if: ${{ needs.check-secrets.outputs.db_secret_ok == 'true' }}
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10

      - name: Install dependencies for migrations
        if: ${{ needs.check-secrets.outputs.db_secret_ok == 'true' }}
        run: bun install --frozen-lockfile

      - name: Run database migrations
        if: ${{ needs.check-secrets.outputs.db_secret_ok == 'true' }}
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: bun run db:migrate

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v2

      - name: Deploy bot service
        run: |
          gcloud run deploy "${{ vars.CLOUD_RUN_SERVICE_BOT || 'household-bot' }}" \
            --source . \
            --region "${{ vars.GCP_REGION || 'europe-west1' }}" \
            --project "${{ secrets.GCP_PROJECT_ID }}" \
            --allow-unauthenticated \
            --quiet

  deploy-skipped:
    name: Deploy skipped (missing config)
    runs-on: ubuntu-latest
    needs: check-secrets
    if: ${{ needs.check-secrets.outputs.eligible_event == 'true' && needs.check-secrets.outputs.secrets_ok == 'false' }}

    steps:
      - name: Print configuration hint
        run: |
          echo "CD skipped: configure required GitHub secrets."
          echo "Required: GCP_PROJECT_ID, GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_SERVICE_ACCOUNT"
          echo "Optional for auto-migrations: DATABASE_URL"