name: Build and Push Image
on:
  push:
    branches:
      - master

jobs:
  build:
    name: Build and push image
    runs-on: ubuntu-latest
    if: gitea.ref == 'refs/heads/master'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The kubeconfig is written FIRST, because the buildx `kubernetes`
      # driver needs it to create its builder pod in the cluster.  This is
      # the same ordering as the working workflows in resbuilder_ai and
      # wedding-photos.
      - name: Create Kubeconfig
        run: |
          mkdir $HOME/.kube
          echo "${{ secrets.KUBEC_CONFIG_BUILDX_NEW_2 }}" > $HOME/.kube/config

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: kubernetes
          driver-opts: |
            namespace=gitea-runner
            qemu.install=true

      - name: Login to Docker Registry
        uses: docker/login-action@v3
        with:
          registry: git.aridgwayweb.com
          username: armistace
          password: ${{ secrets.REG_PASSWORD }}

      - name: Build and Push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          file: flask.Dockerfile
          # amd64 only.  A multi-arch build runs qemu emulation, which
          # crashes the buildkit pod on this NUC (exit 255, SandboxChanged)
          # and the build then hangs for many minutes.  The cluster is
          # amd64, so arm64 images are never used.
          platforms: linux/amd64
          tags: |
            git.aridgwayweb.com/armistace/beer-data:latest

      - name: Deploy
        run: |
          echo "Installing Kubectl"
          apt-get update
          apt-get install -y apt-transport-https ca-certificates curl gnupg
          curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.33/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
          chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
          echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.33/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list
          chmod 644 /etc/apt/sources.list.d/kubernetes.list
          apt-get update
          apt-get install kubectl

          # Do NOT delete the namespace - that would destroy the live
          # Secrets (beer-db, beer-app), which are provisioned by hand.
          # Apply the namespace (idempotent) and the manifests.
          kubectl apply -f kube/beer_namespace.yaml

          # The image-pull credentials.  Created idempotently so a deploy
          # does not fail when they already exist.
          kubectl create secret docker-registry beercred --docker-server=git.aridgwayweb.com --docker-username=armistace --docker-password='${{ secrets.REG_PASSWORD }}' --docker-email=armistace@aridgwayweb.com --namespace=beer --dry-run=client -o yaml | kubectl apply -f -

          kubectl apply -f kube/beer-deployment.yaml
          kubectl apply -f kube/beer-service.yaml

          # `kubectl apply` does NOT roll the pods when only the image
          # changed, because the image tag in the manifest is unchanged.
          # Without the restart the deployment reports success while the
          # old pods keep serving the old image.
          kubectl -n beer rollout restart deployment/beer-deployment
          kubectl -n beer rollout status deployment/beer-deployment --timeout=180s

      - name: Verify the deployed app
        run: |
          # Pods Running is not proof the app works.  Exercise the real
          # endpoints from inside the pod.
          kubectl -n beer exec deploy/beer-deployment -- \
            python -c "import urllib.request,sys; r=urllib.request.urlopen('http://127.0.0.1:5000/healthz'); print('healthz:', r.read().decode()); sys.exit(0 if r.status==200 else 1)"
          kubectl -n beer exec deploy/beer-deployment -- \
            python -c "import urllib.request,sys; r=urllib.request.urlopen('http://127.0.0.1:5000/readyz'); print('readyz:', r.read().decode()); sys.exit(0 if r.status==200 else 1)"