name: Build, Push and GitOps Deploy

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  test-and-deploy:
    runs-on: ubuntu-latest
    # HIER: Das offizielle, voll ausgestattete Image der Pipeline-Macher
    container: catthehacker/ubuntu:act-latest
    steps:
      - name: Install Terraform
        run: |
          apt-get update && apt-get install -y wget gpg lsb-release
          wget -O- https://hashicorp.com | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://hashicorp.com $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/hashicorp.list
          apt-get update && apt-get install -y terraform

      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Log in to Local Registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login forgejo:3000 -u ${{ github.actor }} --password-stdin

      - name: Inject Version into Dockerfile
        run: sed -i "s/{{APP_VERSION}}/${{ github.sha }}/g" Dockerfile

      - name: Build App Image
        run: |
          docker build -t forgejo:3000/${{ github.repository }}:${{ github.sha }} .
          docker build -t forgejo:3000/${{ github.repository }}:latest .

      - name: Push App Image
        run: |
          docker push forgejo:3000/${{ github.repository }}:${{ github.sha }}
          docker push forgejo:3000/${{ github.repository }}:latest

      - name: Terraform Deploy
        run: |
          terraform init
          terraform apply -auto-approve -var="app_version=${{ github.sha }}"

      - name: Verify App Health
        run: |
          echo "Warte auf das Ingress-Routing..."
          sleep 15
          curl --fail --connect-timeout 5 http://local-k3s-platform:80/ || exit 1
          echo "Erfolg: Die App läuft fehlerfrei nach dem Update!"