# CD Pipeline: Auto-deploy to Mac Mini on push to main
#
# Requires a self-hosted Forgejo Actions runner on the Mac Mini.
# Setup: see docs/MAC_MINI_RUNNER_SETUP.md
#
# Flow:
#   Push → main : Detects changed services → rebuilds & restarts only those containers

name: CD Mac Mini

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      service:
        description: 'Service to deploy (or "all" for everything)'
        required: false
        default: 'all'
        type: choice
        options:
          - all
          - matrix-web
          - mana-auth
          - mana-sync
          - mana-media
          - mana-notify
          - mana-api-gateway
          - mana-crawler
          - mana-credits
          - mana-search
          - mana-matrix-bot
          - chat-backend
          - chat-web
          - todo-backend
          - todo-web
          - calendar-backend
          - calendar-web
          - clock-web
          - contacts-backend
          - contacts-web
          - mukke-backend
          - mukke-web
          - storage-backend
          - storage-web

concurrency:
  group: cd-macmini
  cancel-in-progress: false  # Don't cancel in-progress deploys

env:
  PROJECT_DIR: /Users/mana/projects/manacore-monorepo
  COMPOSE_FILE: docker-compose.macmini.yml
  ENV_FILE: .env.macmini
  DEPLOY_NOTIFY_ROOM_ID: ${{ secrets.DEPLOY_NOTIFY_ROOM_ID }}
  DEPLOY_NOTIFY_BOT_TOKEN: ${{ secrets.DEPLOY_NOTIFY_BOT_TOKEN }}
  DOCKER_BUILDKIT: 1
  PATH: /usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin

jobs:
  # ===========================================
  # Detect what changed
  # ===========================================
  detect-changes:
    name: Detect Changes
    runs-on: self-hosted
    if: github.event_name == 'push'
    outputs:
      matrix-web: ${{ steps.changes.outputs.matrix-web }}
      mana-auth: ${{ steps.changes.outputs.mana-auth }}
      mana-sync: ${{ steps.changes.outputs.mana-sync }}
      mana-media: ${{ steps.changes.outputs.mana-media }}
      mana-notify: ${{ steps.changes.outputs.mana-notify }}
      mana-api-gateway: ${{ steps.changes.outputs.mana-api-gateway }}
      mana-crawler: ${{ steps.changes.outputs.mana-crawler }}
      mana-credits: ${{ steps.changes.outputs.mana-credits }}
      mana-search: ${{ steps.changes.outputs.mana-search }}
      chat-backend: ${{ steps.changes.outputs.chat-backend }}
      chat-web: ${{ steps.changes.outputs.chat-web }}
      todo-backend: ${{ steps.changes.outputs.todo-backend }}
      todo-web: ${{ steps.changes.outputs.todo-web }}
      calendar-backend: ${{ steps.changes.outputs.calendar-backend }}
      calendar-web: ${{ steps.changes.outputs.calendar-web }}
      clock-web: ${{ steps.changes.outputs.clock-web }}
      contacts-backend: ${{ steps.changes.outputs.contacts-backend }}
      contacts-web: ${{ steps.changes.outputs.contacts-web }}
      mukke-backend: ${{ steps.changes.outputs.mukke-backend }}
      mukke-web: ${{ steps.changes.outputs.mukke-web }}
      storage-backend: ${{ steps.changes.outputs.storage-backend }}
      storage-web: ${{ steps.changes.outputs.storage-web }}
      mana-matrix-bot: ${{ steps.changes.outputs.mana-matrix-bot }}
      any-changes: ${{ steps.changes.outputs.any-changes }}
    steps:
      - name: Check for changes
        id: changes
        run: |
          cd "${{ env.PROJECT_DIR }}"

          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "")

          SHARED_CHANGED="false"
          if echo "$CHANGED" | grep -qE "^packages/(shared-ui|shared-theme|shared-icons|shared-tailwind|shared-auth|shared-branding|shared-i18n|shared-utils|shared-types)/"; then
            SHARED_CHANGED="true"
          fi

          check_changes() {
            local name=$1
            shift
            local result="false"
            for path in "$@"; do
              if echo "$CHANGED" | grep -q "^$path"; then
                result="true"
                break
              fi
            done
            if [ "$SHARED_CHANGED" == "true" ]; then
              result="true"
            fi
            echo "$name=$result" >> $GITHUB_OUTPUT
          }

          echo "Changed files:"
          echo "$CHANGED" | head -20
          echo "Shared packages changed: $SHARED_CHANGED"

          check_changes "matrix-web"       "apps/matrix/apps/web/" "apps/matrix/packages/"
          check_changes "mana-auth"          "services/mana-auth/"
          check_changes "mana-sync"          "services/mana-sync/" "packages/shared-go/"
          check_changes "mana-media"         "services/mana-media/"
          check_changes "mana-notify"        "services/mana-notify/" "packages/shared-go/"
          check_changes "mana-api-gateway"   "services/mana-api-gateway/" "packages/shared-go/"
          check_changes "mana-crawler"       "services/mana-crawler/" "packages/shared-go/"
          check_changes "mana-credits"       "services/mana-credits/"
          check_changes "mana-search"        "services/mana-search/" "packages/shared-go/"
          check_changes "chat-backend"      "apps/chat/apps/backend/" "apps/chat/packages/"
          check_changes "chat-web"          "apps/chat/apps/web/" "apps/chat/packages/"
          check_changes "todo-backend"      "apps/todo/apps/backend/" "apps/todo/packages/"
          check_changes "todo-web"          "apps/todo/apps/web/" "apps/todo/packages/"
          check_changes "calendar-backend"  "apps/calendar/apps/backend/" "apps/calendar/packages/"
          check_changes "calendar-web"      "apps/calendar/apps/web/" "apps/calendar/packages/"
          check_changes "clock-web"         "apps/clock/apps/web/" "apps/clock/packages/"
          check_changes "contacts-backend"  "apps/contacts/apps/backend/" "apps/contacts/packages/"
          check_changes "contacts-web"      "apps/contacts/apps/web/" "apps/contacts/packages/"
          check_changes "mukke-backend"     "apps/mukke/apps/backend/" "apps/mukke/packages/"
          check_changes "mukke-web"         "apps/mukke/apps/web/" "apps/mukke/packages/"
          check_changes "storage-backend"   "apps/storage/apps/backend/" "apps/storage/packages/"
          check_changes "storage-web"       "apps/storage/apps/web/" "apps/storage/packages/"
          check_changes "mana-matrix-bot"   "services/mana-matrix-bot/"
          check_changes "mana-landing-builder" "services/mana-landing-builder/"

          ANY="false"
          for svc in matrix-web mana-auth mana-sync mana-media mana-notify mana-api-gateway mana-crawler mana-credits mana-search chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web mukke-backend mukke-web storage-backend storage-web mana-matrix-bot mana-landing-builder; do
            val=$(grep "^$svc=" $GITHUB_OUTPUT | tail -1 | cut -d= -f2)
            if [ "$val" == "true" ]; then
              ANY="true"
              break
            fi
          done
          echo "any-changes=$ANY" >> $GITHUB_OUTPUT

  # ===========================================
  # Deploy changed services
  # ===========================================
  deploy:
    name: Deploy
    runs-on: self-hosted
    needs: [detect-changes]
    if: |
      always() &&
      (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.any-changes == 'true') ||
      github.event_name == 'workflow_dispatch'
    steps:
      - name: Pull latest code
        run: |
          cd "${{ env.PROJECT_DIR }}"
          GIT_SSH_COMMAND='ssh -p 2222 -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no' \
            git pull forgejo main

      - name: Init deploy tracking
        id: init
        run: |
          cd "${{ env.PROJECT_DIR }}"
          source scripts/deploy-metrics.sh
          deploy_timer_start
          echo "start_epoch=$DEPLOY_START_EPOCH" >> $GITHUB_OUTPUT
          ensure_deploy_schema

      - name: Ensure env vars exist
        run: |
          cd "${{ env.PROJECT_DIR }}"
          if ! grep -q "CALENDAR_ENCRYPTION_KEY" "${{ env.ENV_FILE }}" 2>/dev/null; then
            echo "CALENDAR_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "${{ env.ENV_FILE }}"
          fi

      - name: Determine services to deploy
        id: services
        run: |
          cd "${{ env.PROJECT_DIR }}"
          SERVICES=""

          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            INPUT="${{ inputs.service }}"
            if [ "$INPUT" == "all" ]; then
              echo "deploy-all=true" >> $GITHUB_OUTPUT
              exit 0
            else
              SERVICES="$INPUT"
            fi
          else
            if [ "${{ needs.detect-changes.outputs.matrix-web }}" == "true" ]; then SERVICES="$SERVICES matrix-web"; fi
            if [ "${{ needs.detect-changes.outputs.mana-auth }}" == "true" ]; then SERVICES="$SERVICES mana-auth"; fi
            if [ "${{ needs.detect-changes.outputs.mana-sync }}" == "true" ]; then SERVICES="$SERVICES mana-sync"; fi
            if [ "${{ needs.detect-changes.outputs.mana-media }}" == "true" ]; then SERVICES="$SERVICES mana-media"; fi
            if [ "${{ needs.detect-changes.outputs.mana-notify }}" == "true" ]; then SERVICES="$SERVICES mana-notify"; fi
            if [ "${{ needs.detect-changes.outputs.mana-api-gateway }}" == "true" ]; then SERVICES="$SERVICES mana-api-gateway"; fi
            if [ "${{ needs.detect-changes.outputs.mana-crawler }}" == "true" ]; then SERVICES="$SERVICES mana-crawler"; fi
            if [ "${{ needs.detect-changes.outputs.mana-credits }}" == "true" ]; then SERVICES="$SERVICES mana-credits"; fi
            if [ "${{ needs.detect-changes.outputs.mana-search }}" == "true" ]; then SERVICES="$SERVICES mana-search"; fi
            if [ "${{ needs.detect-changes.outputs.chat-backend }}" == "true" ]; then SERVICES="$SERVICES chat-backend"; fi
            if [ "${{ needs.detect-changes.outputs.chat-web }}" == "true" ]; then SERVICES="$SERVICES chat-web"; fi
            if [ "${{ needs.detect-changes.outputs.todo-backend }}" == "true" ]; then SERVICES="$SERVICES todo-backend"; fi
            if [ "${{ needs.detect-changes.outputs.todo-web }}" == "true" ]; then SERVICES="$SERVICES todo-web"; fi
            if [ "${{ needs.detect-changes.outputs.calendar-backend }}" == "true" ]; then SERVICES="$SERVICES calendar-backend"; fi
            if [ "${{ needs.detect-changes.outputs.calendar-web }}" == "true" ]; then SERVICES="$SERVICES calendar-web"; fi
            if [ "${{ needs.detect-changes.outputs.clock-web }}" == "true" ]; then SERVICES="$SERVICES clock-web"; fi
            if [ "${{ needs.detect-changes.outputs.contacts-backend }}" == "true" ]; then SERVICES="$SERVICES contacts-backend"; fi
            if [ "${{ needs.detect-changes.outputs.contacts-web }}" == "true" ]; then SERVICES="$SERVICES contacts-web"; fi
            if [ "${{ needs.detect-changes.outputs.mukke-backend }}" == "true" ]; then SERVICES="$SERVICES mukke-backend"; fi
            if [ "${{ needs.detect-changes.outputs.mukke-web }}" == "true" ]; then SERVICES="$SERVICES mukke-web"; fi
            if [ "${{ needs.detect-changes.outputs.storage-backend }}" == "true" ]; then SERVICES="$SERVICES storage-backend"; fi
            if [ "${{ needs.detect-changes.outputs.storage-web }}" == "true" ]; then SERVICES="$SERVICES storage-web"; fi
            if [ "${{ needs.detect-changes.outputs.mana-matrix-bot }}" == "true" ]; then SERVICES="$SERVICES mana-matrix-bot"; fi
            if [ "${{ needs.detect-changes.outputs.mana-landing-builder }}" == "true" ]; then SERVICES="$SERVICES mana-landing-builder"; fi
          fi

          echo "services=$SERVICES" >> $GITHUB_OUTPUT
          echo "deploy-all=false" >> $GITHUB_OUTPUT
          echo "Services to deploy: $SERVICES"

      - name: Build shared base images
        run: |
          cd "${{ env.PROJECT_DIR }}"
          SERVICES="${{ steps.services.outputs.services }}"
          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"

          NEEDS_BASE=false
          NEEDS_WEB_BASE=false
          if [ "$DEPLOY_ALL" == "true" ]; then
            NEEDS_BASE=true; NEEDS_WEB_BASE=true
          else
            for svc in $SERVICES; do
              case "$svc" in *-backend) NEEDS_BASE=true ;; *-web) NEEDS_WEB_BASE=true ;; esac
            done
          fi

          if [ "$NEEDS_BASE" == "true" ]; then
            docker build -f docker/Dockerfile.nestjs-base -t nestjs-base:local . 2>&1 | tail -5
          fi
          if [ "$NEEDS_WEB_BASE" == "true" ]; then
            docker build -f docker/Dockerfile.sveltekit-base -t sveltekit-base:local . 2>&1 | tail -5
          fi

      - name: Build and deploy services
        id: build
        run: |
          cd "${{ env.PROJECT_DIR }}"
          source scripts/deploy-metrics.sh

          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
          SERVICES="${{ steps.services.outputs.services }}"

          if [ "$DEPLOY_ALL" == "true" ]; then
            SERVICES=$(docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" config --services | tr '\n' ' ')
          elif [ -z "$SERVICES" ]; then
            echo "No services to deploy"
            echo "build-times=" >> $GITHUB_OUTPUT
            exit 0
          fi

          echo "=== Rebuilding: $SERVICES ==="
          BUILD_TIMES=""
          for svc in $SERVICES; do
            build_start=$(date +%s)
            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" build "$svc" 2>&1 || true
            build_end=$(date +%s)
            BUILD_TIMES="$BUILD_TIMES $svc:$(( build_end - build_start ))"
          done

          if [ "$DEPLOY_ALL" == "true" ]; then
            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d
          else
            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --no-deps $SERVICES
          fi
          sleep 10

          echo "build-times=$BUILD_TIMES" >> $GITHUB_OUTPUT

      - name: Health checks
        id: health
        run: |
          cd "${{ env.PROJECT_DIR }}"
          source scripts/deploy-metrics.sh

          health_url_for() {
            case "$1" in
              mana-auth)         echo "http://localhost:3001/health" ;;
              matrix-web)        echo "http://localhost:5180/health" ;;
              chat-backend)      echo "http://localhost:3030/health" ;;
              chat-web)          echo "http://localhost:5010/health" ;;
              todo-backend)      echo "http://localhost:3031/health" ;;
              todo-web)          echo "http://localhost:5011/health" ;;
              calendar-backend)  echo "http://localhost:3032/health" ;;
              calendar-web)      echo "http://localhost:5012/health" ;;
              clock-web)         echo "http://localhost:5013/health" ;;
              contacts-backend)  echo "http://localhost:3034/health" ;;
              contacts-web)      echo "http://localhost:5014/health" ;;
              mukke-backend)     echo "http://localhost:3010/health" ;;
              mukke-web)         echo "http://localhost:5180/health" ;;
              storage-backend)   echo "http://localhost:3035/api/v1/health" ;;
              storage-web)       echo "http://localhost:5015/health" ;;
              *)                 echo "" ;;
            esac
          }

          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
          SERVICES="${{ steps.services.outputs.services }}"
          if [ "$DEPLOY_ALL" == "true" ]; then
            SERVICES="mana-auth chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web storage-backend storage-web"
          fi

          HEALTH_RESULTS=""
          for svc in $SERVICES; do
            url=$(health_url_for "$svc")
            if [ -z "$url" ]; then
              HEALTH_RESULTS="$HEALTH_RESULTS $svc:skipped:0:0"
              continue
            fi
            result=$(check_health_timed "$svc" "$url" 2>/dev/null) || true
            status=$(echo "$result" | awk '{print $1}')
            elapsed=$(echo "$result" | awk '{print $2}')
            http_code=$(echo "$result" | awk '{print $3}')
            HEALTH_RESULTS="$HEALTH_RESULTS $svc:${status:-skipped}:${http_code:-0}:${elapsed:-0}"
            [ "$status" = "ok" ] && echo "  ✓ $svc" || echo "  ✗ $svc ($status)"
          done

          echo "health-results=$HEALTH_RESULTS" >> $GITHUB_OUTPUT

      - name: Record deploy metrics
        if: always()
        run: |
          cd "${{ env.PROJECT_DIR }}"
          source scripts/deploy-metrics.sh

          START_EPOCH="${{ steps.init.outputs.start_epoch }}"
          DURATION=$(( $(date +%s) - START_EPOCH ))
          STATUS="success"
          [ "${{ job.status }}" != "success" ] && STATUS="failure"

          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
          SERVICES="${{ steps.services.outputs.services }}"
          [ "$DEPLOY_ALL" == "true" ] && SERVICES_CSV="all" || SERVICES_CSV=$(echo "$SERVICES" | tr ' ' ',')

          COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 200 || echo "unknown")
          RUN_URL="https://git.mana.how/${{ github.repository }}/actions/runs/${{ github.run_id }}"

          DEPLOY_ID=$(insert_deployment \
            "${{ github.run_id }}" "${{ github.run_attempt }}" \
            "${{ github.sha }}" "$COMMIT_MSG" \
            "${{ github.ref_name }}" "${{ github.event_name }}" \
            "${{ github.actor }}" "$SERVICES_CSV" "$STATUS" 2>/dev/null) || DEPLOY_ID=""

          if [ -n "$DEPLOY_ID" ]; then
            finalise_deployment "$DEPLOY_ID" "$STATUS" "$DURATION" 2>/dev/null || true
            BUILD_TIMES="${{ steps.build.outputs.build-times }}"
            HEALTH_RESULTS="${{ steps.health.outputs.health-results }}"
            ALL_SVCS=$(echo "$BUILD_TIMES $HEALTH_RESULTS" | tr ' ' '\n' | cut -d: -f1 | sort -u | tr '\n' ' ')
            for svc in $ALL_SVCS; do
              [ -z "$svc" ] && continue
              build_dur=$(echo "$BUILD_TIMES" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f2 || echo "0")
              startup=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f4 || echo "0")
              health=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f2 || echo "skipped")
              http_code=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f3 || echo "0")
              img_mb=$(get_image_size_mb "$svc" 2>/dev/null || echo "0")
              insert_deploy_service "$DEPLOY_ID" "$svc" "${build_dur:-0}" "$img_mb" "${startup:-0}" "${health:-skipped}" "${http_code:-0}" 2>/dev/null || true
              push_service_metrics "$svc" "${build_dur:-0}" "$img_mb" "$health" 2>/dev/null || true
            done
          fi
          push_deploy_metrics "$STATUS" "$DURATION" "${{ github.ref_name }}" 2>/dev/null || true

      - name: Notify on failure
        if: failure()
        run: |
          cd "${{ env.PROJECT_DIR }}"
          SERVICES="${{ steps.services.outputs.services }}"
          [ "${{ steps.services.outputs.deploy-all }}" == "true" ] && SERVICES="all"
          COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 100)
          RUN_URL="https://git.mana.how/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          MSG="⚠️ **Deploy failed**\n\n**Services:** ${SERVICES}\n**Commit:** ${COMMIT_MSG}\n**By:** ${{ github.actor }}\n**[View logs](${RUN_URL})**"

          ROOM_ID="${DEPLOY_NOTIFY_ROOM_ID:-}"
          BOT_TOKEN="${DEPLOY_NOTIFY_BOT_TOKEN:-}"
          if [ -n "$ROOM_ID" ] && [ -n "$BOT_TOKEN" ]; then
            TXN_ID="deploy-$(date +%s)"
            curl -s -X PUT \
              "http://localhost:8008/_matrix/client/v3/rooms/${ROOM_ID}/send/m.room.message/${TXN_ID}" \
              -H "Authorization: Bearer ${BOT_TOKEN}" \
              -H "Content-Type: application/json" \
              -d "{\"msgtype\":\"m.text\",\"body\":\"Deploy failed: ${SERVICES}\"}" || true
          fi

      - name: Cleanup old images
        if: always()
        run: |
          docker image prune -f 2>/dev/null || true
          docker image prune -a -f --filter "until=168h" 2>/dev/null || true