name: ci

on:
  push:
    branches:
      - "main"
  pull_request:
    branches:
      - "main"

env:
  APP_NAME: aws-dodo
  REGISTRY_URL: registry.bboysoul.cn
  IMAGE_NAME: registry.bboysoul.cn/dodo
  GIT_EMAIL: bboysoulcn@gmail.com
  GIT_USER: bboysoul
  YAML_REPO: git.bboysoul.cn/bboysoul/kubernetes-yaml
  YAML_PATH: kubernetes-yaml/aws-k8s/dodo
  ARGOCD_USER: admin
  ARGOCD_URL: argocd.bboysoul.cn

jobs:
  gitleaks:
    runs-on: docker
    container:
      options: --user=root
    steps:
      - name: Check out repository history
        uses: https://github.com/actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Scan Git history for secrets
        shell: bash
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.30.1
          ARCHIVE="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          curl --fail --silent --show-error --location \
            --output "/tmp/${ARCHIVE}" \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${ARCHIVE}"
          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/${ARCHIVE}" | sha256sum --check --strict
          tar -xzf "/tmp/${ARCHIVE}" -C /usr/local/bin gitleaks
          gitleaks git --redact --no-banner --verbose --log-opts="--all" .

  docker:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    needs: gitleaks
    runs-on: docker
    container:
      options: --user=root
    steps:
      - name: Set up Docker Buildx
        uses: https://github.com/docker/setup-buildx-action@v2

      - name: Login to Docker Registry
        uses: https://github.com/docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY_URL }}
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Build and push
        uses: https://github.com/docker/build-push-action@v6
        with:
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}:latest
            ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
          cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
          cache-to: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max

      - name: Update kustomize image
        run: |
          git config --global user.email "${{ env.GIT_EMAIL }}"
          git config --global user.name "${{ env.GIT_USER }}"
          git clone https://${{ env.GIT_USER }}:${{ secrets.CI_GIT_TOKEN }}@${{ env.YAML_REPO }}.git
          cd ${{ env.YAML_PATH }}
          kustomize edit set image ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
          git add .
          git commit -m "set image ${{ env.IMAGE_NAME }}:${{ gitea.sha }}"
          git push

      - name: Install ArgoCD CLI
        run: |
          curl -sSL -o /usr/local/bin/argocd \
            https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
          chmod +x /usr/local/bin/argocd

      - name: ArgoCD sync
        run: |
          argocd login ${{ env.ARGOCD_URL }} \
            --username ${{ env.ARGOCD_USER }} \
            --password ${{ secrets.ARGOCD_PASSWORD }} \
            --insecure \
            --grpc-web
          argocd app sync ${{ env.APP_NAME }} --grpc-web
          argocd app wait ${{ env.APP_NAME }} \
            --health \
            --timeout 300 \
            --grpc-web