name: Build, Push and GitOps Deploy

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  test-and-deploy:
    runs-on: ubuntu-latest
    container: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Trust Local Nginx Certificate Inside Container
        run: |
          mkdir -p /usr/local/share/ca-certificates/
          cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
          update-ca-certificates

      - name: Log in to Local Registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login localhost:3005 -u ${{ github.actor }} --password-stdin

      - name: Inject Version into Dockerfile
        run: sed -i "s/{{APP_VERSION}}/${{ github.sha }}/g" Dockerfile

      - name: Build App Image
        run: |
          docker build -t localhost:3005/${{ github.repository }}:${{ github.sha }} .
          docker build -t localhost:3005/${{ github.repository }}:latest .

      - name: Push App Image
        run: |
          docker push localhost:3005/${{ github.repository }}:${{ github.sha }}
          docker push localhost:3005/${{ github.repository }}:latest

      # --- DIE OFFIZIELLE INFRASTRUKTUR-RETTUNG ---
      # Schreibt die echten Cluster-Zugangsdaten direkt sicher in den Workspace
      - name: Prepare Kubernetes Access
        run: |
          echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
          chmod 600 ./kind_kubeconfig

      - name: Terraform Deploy
        run: |
          # 1. Wir löschen die kollidierenden Reste fliegend über den Containernamen
          docker exec local-k3s-platform kubectl delete deployment webapp --namespace default --ignore-not-found=true 2>/dev/null || true
          docker exec local-k3s-platform kubectl delete service webapp-service --namespace default --ignore-not-found=true 2>/dev/null || true
          docker exec local-k3s-platform kubectl delete ingress app-ingress --namespace default --ignore-not-found=true 2>/dev/null || true
          
          # 2. Wir löschen das Helm-Release direkt aus dem kube-system Namespace
          docker exec local-k3s-platform kubectl delete deployment ingress-nginx-controller --namespace kube-system --ignore-not-found=true 2>/dev/null || true
          docker exec local-k3s-platform kubectl delete service ingress-nginx-controller --namespace kube-system --ignore-not-found=true 2>/dev/null || true
          docker exec local-k3s-platform kubectl delete service ingress-nginx-controller-admission --namespace kube-system --ignore-not-found=true 2>/dev/null || true
          docker exec local-k3s-platform kubectl delete secret -n kube-system -l owner=helm --ignore-not-found=true 2>/dev/null || true

          # 3. Jetzt hat Terraform freie Bahn und setzt das Update fehlerfrei ab!
          terraform init
          terraform apply -auto-approve -var="app_version=${{ github.sha }}"

      - name: Verify App Health
        run: |
          echo "Warte auf das Ingress-Routing..."
          sleep 15
          curl --fail --connect-timeout 5 http://local-k3s-platform:80/ || exit 1
          echo "Erfolg: Die App läuft fehlerfrei nach dem Update!"