# Gitea Actions workflow for asset-engine.
#
# THIS FILE LIVES IN THE ASSET-ENGINE REPO, NOT HERE.
# Copy to vh/asset-engine:.gitea/workflows/deploy.yaml and commit.
# (The canonical copy lives in the asset-engine repo; this file is a
# reference for what shape the workflow takes.)
#
# What it does on every push to main (and on manual workflow_dispatch):
#   1. Checks out asset-engine itself (the triggering repo).
#   2. Checks out vh/esh-pfi-infrastructure to pick up the elway
#      playbook and helper scripts.
#   3. Configures SSH so elway can reach ana-docker.
#   4. Runs `scripts/elway ana-docker --playbook playbooks/deploy-asset-engine.yaml`
#      pinning to the commit SHA that triggered the workflow.
#
# Required Actions secrets (configure under
# https://gitea.phasefinal.com/vh/asset-engine/settings/actions/secrets,
# or org-level for reuse across repos):
#
#   DEPLOY_SSH_KEY    Private SSH key whose pubkey is in
#                     ~lkraven/.ssh/authorized_keys on ana-docker.
#                     Used by the runner to invoke the elway playbook.
#                     Generate fresh; don't reuse a personal key.
#
#   MGMT_REPO_TOKEN   Gitea PAT (read:repository scope) on
#                     vh/esh-pfi-infrastructure, used to clone the
#                     management repo. Generate at
#                     https://gitea.phasefinal.com/-/user/settings/applications.

name: Deploy asset-engine

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    # `pfi-fleet` matches the central runner on ana-docker. Pin to
    # `ana-docker` instead if you want to refuse running on a future
    # site-local runner. The runner's label embeds a default image
    # (node:20-bookworm-slim) — has node + git out of the box, so
    # actions/checkout@v4 (a JS action) works without a custom
    # container. We just apt-install python3 + pyyaml for elway.
    runs-on: pfi-fleet

    steps:
      - name: Install playbook prerequisites
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends \
            python3 python3-yaml openssh-client
          rm -rf /var/lib/apt/lists/*

      - name: Checkout asset-engine (triggering repo)
        uses: actions/checkout@v4

      - name: Checkout management repo (eshpfi-management)
        uses: actions/checkout@v4
        with:
          repository: vh/esh-pfi-infrastructure
          token: ${{ secrets.MGMT_REPO_TOKEN }}
          path: _mgmt

      - name: Configure SSH to ana-docker
        run: |
          mkdir -p ~/.ssh
          # The DEPLOY_SSH_KEY secret is the full private key contents,
          # newline-terminated. ssh refuses keys that aren't 0600.
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

          # ssh_config alias so elway resolves "ana-docker" the same
          # way it would on a workstation. accept-new is fine for a
          # fresh job container — host key gets cached for the lifetime
          # of this job only.
          cat > ~/.ssh/config <<'EOF'
          Host ana-docker
            HostName 10.250.50.70
            User lkraven
            IdentityFile ~/.ssh/id_ed25519
            StrictHostKeyChecking accept-new
          EOF
          chmod 600 ~/.ssh/config

      - name: Deploy asset-engine (elway playbook, pinned to this commit)
        working-directory: _mgmt
        run: |
          scripts/elway ana-docker \
            --playbook playbooks/deploy-asset-engine.yaml \
            --var ref=${{ github.sha }}