name: Build and Deploy

on:
  push:
    branches:
      - master
      - dev

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        run: |
          git clone --depth=1 --branch=${{ github.ref_name }} https://gitea.airlabs.art/${{ github.repository }}.git .

      - name: Set environment by branch
        run: |
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          BUILD_DATE=$(date +%Y%m%d)

          if [[ "${{ github.ref_name }}" == "master" ]]; then
            echo "IMAGE_TAG=prod-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
            echo "CR_SERVER_ACTIVE=gitea-prod-cn-shanghai.cr.volces.com" >> $GITHUB_ENV
            echo "CR_USERNAME_ACTIVE=seaislee@76339115" >> $GITHUB_ENV
            echo "CR_PASSWORD_ACTIVE=${{ secrets.CR_PROD_PASSWORD }}" >> $GITHUB_ENV
            echo "CR_ORG=prod" >> $GITHUB_ENV
            echo "DEPLOY_ENV=production" >> $GITHUB_ENV
            echo "DOMAIN_WEB=airshelf.airlabs.art" >> $GITHUB_ENV
            echo "DOMAIN_CORE=airshelf-web.airlabs.art" >> $GITHUB_ENV
          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
            echo "IMAGE_TAG=dev-${BUILD_DATE}-${SHORT_SHA}" >> $GITHUB_ENV
            echo "CR_SERVER_ACTIVE=${{ secrets.CR_SERVER }}" >> $GITHUB_ENV
            echo "CR_USERNAME_ACTIVE=${{ secrets.CR_USERNAME }}" >> $GITHUB_ENV
            echo "CR_PASSWORD_ACTIVE=${{ secrets.CR_PASSWORD }}" >> $GITHUB_ENV
            echo "CR_ORG=dev" >> $GITHUB_ENV
            echo "DEPLOY_ENV=development" >> $GITHUB_ENV
            echo "DOMAIN_WEB=airshelf.test.airlabs.art" >> $GITHUB_ENV
            echo "DOMAIN_CORE=airshelf-web.test.airlabs.art" >> $GITHUB_ENV
          fi

      - name: Login to Volcano Engine CR
        run: |
          echo "${{ env.CR_PASSWORD_ACTIVE }}" | docker login --username "${{ env.CR_USERNAME_ACTIVE }}" --password-stdin ${{ env.CR_SERVER_ACTIVE }}

      - name: Build and Push Web
        id: build_web
        run: |
          set -o pipefail
          ok=0
          for attempt in 1 2 3; do
            echo "Build web attempt $attempt/3..."
            DOCKER_BUILDKIT=0 docker build \
              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-web:${{ env.IMAGE_TAG }} \
              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-web:latest \
              "./电商AI平台" 2>&1 | tee /tmp/build.log && { ok=1; break; }
            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
          done
          [ $ok -eq 1 ] || { echo "ERROR: web build failed after 3 attempts"; exit 1; }
          ok=0
          for attempt in 1 2 3; do
            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-web:${{ env.IMAGE_TAG }} && \
            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-web:latest && { ok=1; break; }
            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
          done
          [ $ok -eq 1 ] || { echo "ERROR: web push failed after 3 attempts"; exit 1; }

      - name: Build and Push Core API (Django)
        id: build_core_api
        run: |
          set -o pipefail
          ok=0
          for attempt in 1 2 3; do
            echo "Build core-api attempt $attempt/3..."
            DOCKER_BUILDKIT=0 docker build \
              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:${{ env.IMAGE_TAG }} \
              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:latest \
              "./core/backend" 2>&1 | tee /tmp/build-core-api.log && { ok=1; break; }
            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
          done
          [ $ok -eq 1 ] || { echo "ERROR: core-api build failed after 3 attempts"; exit 1; }
          ok=0
          for attempt in 1 2 3; do
            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:${{ env.IMAGE_TAG }} && \
            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-api:latest && { ok=1; break; }
            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
          done
          [ $ok -eq 1 ] || { echo "ERROR: core-api push failed after 3 attempts"; exit 1; }

      - name: Build and Push Core Web (React/Vite)
        id: build_core_web
        run: |
          set -o pipefail
          ok=0
          for attempt in 1 2 3; do
            echo "Build core-web attempt $attempt/3..."
            DOCKER_BUILDKIT=0 docker build \
              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:${{ env.IMAGE_TAG }} \
              --tag ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:latest \
              "./core/frontend" 2>&1 | tee /tmp/build-core-web.log && { ok=1; break; }
            echo "Attempt $attempt failed, retrying in 10s..." && sleep 10
          done
          [ $ok -eq 1 ] || { echo "ERROR: core-web build failed after 3 attempts"; exit 1; }
          ok=0
          for attempt in 1 2 3; do
            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:${{ env.IMAGE_TAG }} && \
            docker push ${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}/airshelf-core-web:latest && { ok=1; break; }
            echo "Push attempt $attempt failed, retrying in 10s..." && sleep 10
          done
          [ $ok -eq 1 ] || { echo "ERROR: core-web push failed after 3 attempts"; exit 1; }

      - name: Setup Kubectl
        run: |
          if ! command -v kubectl &>/dev/null; then
            ok=0
            for attempt in 1 2 3; do
              curl -LO "https://files.m.daocloud.io/dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl" && { ok=1; break; }
              echo "Download attempt $attempt failed, retrying in 5s..." && sleep 5
            done
            [ $ok -eq 1 ] || { echo "ERROR: kubectl download failed after 3 attempts"; exit 1; }
            chmod +x kubectl && mv kubectl /usr/bin/kubectl
          fi
          kubectl version --client

      - name: Set kubeconfig
        run: |
          mkdir -p $HOME/.kube
          if [[ "${{ github.ref_name }}" == "master" ]]; then
            printf '%s\n' '${{ secrets.VOLCANO_PROD_KUBE_CONFIG }}' > $HOME/.kube/config
          elif [[ "${{ github.ref_name }}" == "dev" ]]; then
            printf '%s\n' '${{ secrets.VOLCANO_TEST_KUBE_CONFIG }}' > $HOME/.kube/config
          fi
          chmod 600 $HOME/.kube/config
          echo "kubeconfig lines: $(wc -l < $HOME/.kube/config)"
          grep server $HOME/.kube/config || echo "WARNING: no server found in kubeconfig"

      - name: Deploy to K3s
        id: deploy
        run: |
          echo "Environment: ${{ env.DEPLOY_ENV }}"
          CR_IMAGE="${{ env.CR_SERVER_ACTIVE }}/${{ env.CR_ORG }}"

          # Replace image placeholders (PRD design site)
          sed -i "s|\${CI_REGISTRY_IMAGE}/airshelf-web:latest|${CR_IMAGE}/airshelf-web:${{ env.IMAGE_TAG }}|g" k8s/web-deployment.yaml

          # Replace domain placeholder in ingress
          sed -i "s|airshelf.airlabs.art|${{ env.DOMAIN_WEB }}|g" k8s/ingress.yaml

          # ===== Core (real app) image + domain substitution =====
          sed -i "s|\${CI_REGISTRY_IMAGE}/airshelf-core-api:latest|${CR_IMAGE}/airshelf-core-api:${{ env.IMAGE_TAG }}|g" k8s/core/api-deployment.yaml k8s/core/worker-deployment.yaml
          sed -i "s|\${CI_REGISTRY_IMAGE}/airshelf-core-web:latest|${CR_IMAGE}/airshelf-core-web:${{ env.IMAGE_TAG }}|g" k8s/core/web-deployment.yaml
          sed -i "s|airshelf-web.airlabs.art|${{ env.DOMAIN_CORE }}|g" k8s/core/ingress.yaml

          # ===== Build core env file: core/backend/.env + production overrides =====
          # Source of truth is core/backend/.env (committed; real MySQL + managed Redis + TOS + ARK).
          # Override only the env-specific bits; DB_BIND_ADDRESS is dropped (dev LAN IP
          # has no NIC in-cluster), settings -> production, hosts/CSRF/CORS -> the domain.
          grep -vE '^\s*(#|$)' core/backend/.env \
            | grep -vE '^(DJANGO_SETTINGS_MODULE|DJANGO_DEBUG|DB_BIND_ADDRESS|DJANGO_ALLOWED_HOSTS|DJANGO_CSRF_TRUSTED_ORIGINS|CORS_ALLOWED_ORIGINS)=' \
            > /tmp/core.env
          {
            echo "DJANGO_SETTINGS_MODULE=airshelf.settings.production"
            echo "DJANGO_DEBUG=false"
            echo "DJANGO_ALLOWED_HOSTS=airshelf-web.airlabs.art,${{ env.DOMAIN_CORE }},localhost,127.0.0.1"
            echo "DJANGO_CSRF_TRUSTED_ORIGINS=https://airshelf-web.airlabs.art,https://${{ env.DOMAIN_CORE }}"
            echo "CORS_ALLOWED_ORIGINS=https://airshelf-web.airlabs.art,https://${{ env.DOMAIN_CORE }}"
          } >> /tmp/core.env

          # All kubectl operations with retry (K3s 内网连接可能抖动)
          export KUBECTL_TIMEOUT="--request-timeout=4s"

          ok=0
          for attempt in 1 2 3 4 5; do
            echo "Deploy attempt $attempt/5..."
            {
              # Create/update image pull secret for CR
              kubectl $KUBECTL_TIMEOUT create secret docker-registry cr-pull-secret \
                --docker-server="${{ env.CR_SERVER_ACTIVE }}" \
                --docker-username="${{ env.CR_USERNAME_ACTIVE }}" \
                --docker-password="${{ env.CR_PASSWORD_ACTIVE }}" \
                --dry-run=client -o yaml | kubectl $KUBECTL_TIMEOUT apply -f -

              # Core backend env secret (real MySQL / managed Redis / TOS / ARK)
              kubectl $KUBECTL_TIMEOUT create secret generic airshelf-core-env \
                --from-env-file=/tmp/core.env \
                --dry-run=client -o yaml | kubectl $KUBECTL_TIMEOUT apply -f -

              # Apply manifests — shared infra
              kubectl $KUBECTL_TIMEOUT apply -f k8s/cert-manager-issuer.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/redirect-https-middleware.yaml

              # PRD design site
              kubectl $KUBECTL_TIMEOUT apply -f k8s/web-deployment.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/ingress.yaml

              # Core real app (api + celery worker + web + ingress)
              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/api-deployment.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/worker-deployment.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/web-deployment.yaml
              kubectl $KUBECTL_TIMEOUT apply -f k8s/core/ingress.yaml

              # Preserve real client IP
              kubectl $KUBECTL_TIMEOUT patch svc traefik -n kube-system -p '{"spec":{"externalTrafficPolicy":"Local"}}' 2>/dev/null || true

              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-web
              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-core-api
              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-core-worker
              kubectl $KUBECTL_TIMEOUT rollout restart deployment/airshelf-core-web
            } 2>&1 | tee /tmp/deploy.log && { ok=1; break; }
            echo "Attempt $attempt failed, retrying in 30s..."
            sleep 30
          done
          [ $ok -eq 1 ] || { echo "ERROR: deploy to K3s failed after 5 attempts — check /tmp/deploy.log"; exit 1; }

      # ===== Log Center: failure reporting =====
      - name: Report failure to Log Center
        if: failure()
        run: |
          BUILD_LOG=""
          DEPLOY_LOG=""
          FAILED_STEP="unknown"

          if [[ "${{ steps.build_web.outcome }}" == "failure" ]]; then
            FAILED_STEP="build"
            if [ -f /tmp/build.log ]; then
              BUILD_LOG=$(tail -50 /tmp/build.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
            fi
          elif [[ "${{ steps.build_core_api.outcome }}" == "failure" ]]; then
            FAILED_STEP="build"
            if [ -f /tmp/build-core-api.log ]; then
              BUILD_LOG=$(tail -50 /tmp/build-core-api.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
            fi
          elif [[ "${{ steps.build_core_web.outcome }}" == "failure" ]]; then
            FAILED_STEP="build"
            if [ -f /tmp/build-core-web.log ]; then
              BUILD_LOG=$(tail -50 /tmp/build-core-web.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
            fi
          elif [[ "${{ steps.deploy.outcome }}" == "failure" ]]; then
            FAILED_STEP="deploy"
            if [ -f /tmp/deploy.log ]; then
              DEPLOY_LOG=$(tail -50 /tmp/deploy.log | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g')
            fi
          fi

          ERROR_LOG="${BUILD_LOG}${DEPLOY_LOG}"
          if [ -z "$ERROR_LOG" ]; then
            ERROR_LOG="No captured output. Check Gitea Actions UI for details."
          fi

          if [[ "$FAILED_STEP" == "deploy" ]]; then
            SOURCE="deployment"
            ERROR_TYPE="DeployError"
          else
            SOURCE="cicd"
            ERROR_TYPE="DockerBuildError"
          fi

          curl -s -X POST "https://qiyuan-log-center-api.airlabs.art/api/v1/logs/report" \
            -H "Content-Type: application/json" \
            -d "{
              \"project_id\": \"airshelf\",
              \"environment\": \"${{ env.DEPLOY_ENV }}\",
              \"level\": \"ERROR\",
              \"source\": \"${SOURCE}\",
              \"commit_hash\": \"${{ github.sha }}\",
              \"repo_url\": \"https://gitea.airlabs.art/zyc/AirShelf.git\",
              \"error\": {
                \"type\": \"${ERROR_TYPE}\",
                \"message\": \"[${FAILED_STEP}] Build and Deploy failed on branch ${{ github.ref_name }}\",
                \"stack_trace\": [\"${ERROR_LOG}\"]
              },
              \"context\": {
                \"job_name\": \"build-and-deploy\",
                \"step_name\": \"${FAILED_STEP}\",
                \"workflow\": \"${{ github.workflow }}\",
                \"run_id\": \"${{ github.run_number }}\",
                \"branch\": \"${{ github.ref_name }}\",
                \"actor\": \"${{ github.actor }}\",
                \"commit\": \"${{ github.sha }}\",
                \"run_url\": \"https://gitea.airlabs.art/${{ github.repository }}/actions/runs/${{ github.run_number }}\"
              }
            }" || true

      # ===== Cleanup: remove unused Docker resources =====
      - name: Docker Cleanup
        if: always()
        run: |
          docker container prune -f
          docker image prune -f
          docker builder prune -a -f
          echo "Disk usage after cleanup:"
          df -h / | tail -1