name: __APP_NAME__ — build & deploy

on:
  push:
    branches: [main]
    paths:
      - 'code/**'
      - 'helm/**'
      - '.gitea/workflows/__APP_NAME__-build.yaml'

jobs:
  # Tests + build + push a Harbor — patrón ADR-038 reusable workflow.
  build:
    uses: coralware/IDP/.gitea/workflows/_python-microservice.yaml@main
    with:
      service_name: __APP_NAME__
      service_dir: code
      uses_metrics: false
      coverage_threshold: 80
      trivy_exit_code: 0
      enforce_rollback: false

  # Deploy al cluster del tenant — Helm upgrade --install (sin hook Alembic).
  helm-deploy:
    needs: build
    runs-on: [self-hosted, linux/amd64]
    container: alpine/helm:3.14.4
    steps:
      - uses: actions/checkout@v4

      - name: Install kubectl
        run: apk add --no-cache kubectl

      - name: Decodificar kubeconfig del tenant
        env:
          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_TENANT_B64 }}
        run: |
          if [ -z "$KUBECONFIG_B64" ]; then
            echo "ERROR: secret KUBECONFIG_TENANT_B64 no configurado en el proyecto Gitea."
            echo "tenant-manager debe provisionarlo al crear el repo."
            exit 1
          fi
          mkdir -p /root/.kube
          echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
          chmod 600 /root/.kube/config

      - name: Helm upgrade --install
        env:
          TENANT_ID: ${{ vars.TENANT_ID }}
          TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
          TENANT_TIER: ${{ vars.TENANT_TIER }}
          IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
        # ADR-054: namespace funcional fijo en cluster tenant — el cluster ya es el sandbox.
        run: |
          helm upgrade --install __APP_NAME__ ./helm/__APP_NAME__ \
            --namespace apps \
            --create-namespace \
            --set image.tag=${IMAGE_TAG} \
            --set tenantId=${TENANT_ID} \
            --set tenantIdNodashes=${TENANT_ID_NODASHES} \
            --set tier=${TENANT_TIER} \
            --wait --timeout 5m

      - name: Verificar rollout
        run: |
          kubectl -n apps rollout status deploy/__APP_NAME__ --timeout=3m

      - name: Smoke check post-deploy
        env:
          INGRESS_HOST: __APP_NAME__-${{ vars.TENANT_ID_NODASHES }}.apps.coralware.cloud
        run: |
          for i in $(seq 1 12); do
            if wget -q -O - --timeout=10 "https://${INGRESS_HOST}/health" | grep -q '"status":"ok"'; then
              echo "Smoke OK: /health responde 200"
              exit 0
            fi
            echo "Intento ${i}/12 — /health aún no responde, esperando 5s…"
            sleep 5
          done
          echo "ERROR: /health no respondió 200 dentro del timeout"
          exit 1