name: Build and deploy Bridgeman Accessible Hashicorp Vault Implementation

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy:
    runs-on: self-hosted
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # Build a new container image from the code
      - name: Update Image
        run: |
          # Parse information from the metadata.yaml file
          IMAGE_NAME=$(yq '.name' metadata.yaml)
          IMAGE_NAME=${IMAGE_NAME#\"}  # Remove leading quote
          IMAGE_NAME=${IMAGE_NAME%\"}  # Remove trailing quote
          echo "Image Name: $IMAGE_NAME"
          echo "IMAGE_NAME=$IMAGE_NAME" >> $GITHUB_ENV

          LOCAL_VERSION=$(yq '.version' metadata.yaml)
          LOCAL_VERSION=${LOCAL_VERSION#\"}  # Remove leading quote
          LOCAL_VERSION=${LOCAL_VERSION%\"}  # Remove trailing quote
          echo "Image Local Version: $LOCAL_VERSION"

          REMOTE_TAGS_WORK_OUTPUT=$(skopeo list-tags docker://${{ secrets.REPOSITORY_HOSTNAME }}/k8s/$IMAGE_NAME 2>/dev/null || echo "")
          if [ -n "$REMOTE_TAGS_WORK_OUTPUT" ]; then
            IFS=' ' read -r -a REMOTE_TAGS <<< $(skopeo list-tags docker://${{ secrets.REPOSITORY_HOSTNAME }}/k8s/$IMAGE_NAME | jq -r '.Tags | @sh')
          else
            echo "Image not found in the repository. Will need to add it..."
            
            # Set a blank value so that it WON'T match the local version
            IFS=' ' read -r -a REMOTE_TAGS <<< ""
          fi

          echo "Remote Tags (number: ${#REMOTE_TAGS[@]}): ${REMOTE_TAGS[@]}"

          has_match='false'
          if [ ${#REMOTE_TAGS[@]} -gt 0 ]; then
            # Loop through the remote tags and check if any of them match the local version
            for REMOTE_TAG in ${REMOTE_TAGS[@]}; do
              REMOTE_TAG=${REMOTE_TAG#\'}  # Remove leading quote
              REMOTE_TAG=${REMOTE_TAG%\'}  # Remove trailing quote

              # Check if the remote tag is the same as the local tag
              if [ "$REMOTE_TAG" == "v$LOCAL_VERSION" ]; then
                echo "Remote version matches local version!"
                has_match='true'
                break
              fi
            done
          fi
          
          # If a remote tag that matches the local version already exists, increment the local version's patch version
          if [ "$has_match" == 'true' ]; then
            echo "Because the remote version matches the local version, we need to increment the local version's patch number."
            
            # Increment the patch version of the local version (Ex. 1.0.0 -> 1.0.1)
            IFS='.' read -r major minor patch <<< "$LOCAL_VERSION"
            patch=$((patch + 1))
            NEW_LOCAL_VERSION="$major.$minor.$patch"
            
            echo "New Local Version: $NEW_LOCAL_VERSION"
            echo "Committing container version change..."

            sed -i "s|version: $LOCAL_VERSION|version: $NEW_LOCAL_VERSION|g" metadata.yaml

            LOCAL_VERSION=$NEW_LOCAL_VERSION

            # Update remote URL to use the GITHUB_TOKEN for authentication
            git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git

            # Setup git user details for committing the version change and tag
            git config user.name "GitHub Actions"
            git config user.email "actions@github.com"

            # Commit the version change to the `package.json` file
            git add metadata.yaml
            git commit -m "[Github Actions] Update container version to $(jq -r '.version' package.json)"

            # Push the changes to the repository
            git push origin HEAD:main
          fi

          # Build and push the init container image to the repository
          docker build -t ${{ secrets.REPOSITORY_HOSTNAME }}/k8s/$IMAGE_NAME:v$LOCAL_VERSION .
          docker push ${{ secrets.REPOSITORY_HOSTNAME }}/k8s/$IMAGE_NAME:v$LOCAL_VERSION

          # Note, this is the version NOT the tag
          # This is because the `update-k8s-deployment-image` script automatically prepends the `v` to the version
          echo "CONTAINER_IMAGE_VERSION=$LOCAL_VERSION" >> $GITHUB_ENV
    
      - name: Update vault images in various deployments
        run: |
          # Update the Hashicorp Vault instance for the Account Dashboard
          update-k8s-deployment-image \
            --image-version ${{ env.CONTAINER_IMAGE_VERSION }} \
            --namespace ciam-account-dashboard \
            --deployment-name account-pass-vault \
            --container-name account-pass-vault \
            --image-name ${{ secrets.REPOSITORY_HOSTNAME }}/k8s/${{ env.IMAGE_NAME }}
          
          # Update the Hashicopr Vault instance for the Services Dashboard
          #update-k8s-deployment-image \
          #  --image-version ${{ env.CONTAINER_IMAGE_VERSION }} \
          #  --namespace ciam-services-dashboard \
          #  --deployment-name services-vault \
          #  --container-name services-vault \
          #  --image-name ${{ secrets.REPOSITORY_HOSTNAME }}/k8s/${{ env.IMAGE_NAME }}

          # Update the Hashicorp Vault instance for the Accessible Events Platform (AEP)
          #update-k8s-deployment-image \
          #  --image-version ${{ env.CONTAINER_IMAGE_VERSION }} \
          #  --namespace aep \
          #  --deployment-name aep-vault \
          #  --container-name aep-vault \
          #  --image-name ${{ secrets.REPOSITORY_HOSTNAME }}/k8s/${{ env.IMAGE_NAME }}