name: CD

on:
  push:
    branches: [master, main]
  pull_request:

env:
  IMAGE_BASE: ${{ secrets.AR_LOCATION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT }}/${{ secrets.AR_REPO }}

jobs:
  build:
    runs-on: ubuntu-latest
    # Sem `if: hashFiles(...)` no nível do job: hashFiles é avaliado ANTES do
    # checkout (workspace vazio) → condição sempre falsa → job pulado com status
    # success. Foi o que congelou o deploy do frontend por semanas.
    steps:
      - uses: actions/checkout@v4

      - name: Auth GCP
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ secrets.GCP_PROJECT }}

      # Build + push + deploy rodam no Google Cloud Build: o runner do Gitea não
      # tem daemon Docker. Ver cloudbuild.yaml.
      - name: Build + deploy via Cloud Build (apenas em push pra master/main)
        if: github.event_name == 'push'
        env:
          IMG_TAG: lab-${{ gitea.run_number }}
          GKE_CLUSTER: ${{ secrets.GKE_CLUSTER }}
          GKE_REGION: ${{ secrets.GKE_REGION }}
          GCP_PROJECT: ${{ secrets.GCP_PROJECT }}
          K8S_NAMESPACE: ${{ secrets.K8S_NAMESPACE }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          IMG="${IMAGE_BASE}/${{ gitea.event.repository.name }}:${IMG_TAG}"

          SUBS="_IMAGE=${IMG}"
          SUBS="${SUBS},_NPM_TOKEN=${NPM_TOKEN}"
          SUBS="${SUBS},_GKE_CLUSTER=${GKE_CLUSTER}"
          SUBS="${SUBS},_GKE_REGION=${GKE_REGION}"
          SUBS="${SUBS},_GCP_PROJECT=${GCP_PROJECT}"
          SUBS="${SUBS},_K8S_NAMESPACE=${K8S_NAMESPACE}"

          gcloud builds submit --project "${GCP_PROJECT}" \
            --config cloudbuild.yaml \
            --substitutions="${SUBS}" \
            .