name: Build and Push to GCP Artifact Registry (production)

permissions:
  contents: read

on:
  push:
    tags:
      - v*

env:
  GCP_PROJECT_ID: ${{ secrets.PROD_GCP_PROJECT_ID }}
  GCP_AR_LOCATION: ${{ secrets.PROD_GCP_AR_LOCATION }}
  GCP_AR_REPO: ${{ secrets.PROD_GCP_AR_REPO }}
  IMAGE_NAME: ${{ secrets.PROD_IMAGE_NAME }}
  GCP_SA_KEY: ${{ secrets.PROD_GCP_SA_KEY }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Resolve and verify version
        id: version
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          # A running instance serves this version at /openapi.json, so it must
          # match the version being deployed.
          PYPROJECT_VERSION="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)"
          if [[ "$VERSION" != "$PYPROJECT_VERSION" ]]; then
            echo "::error::pyproject.toml version '$PYPROJECT_VERSION' does not match tag '$GITHUB_REF_NAME'. Bump pyproject.toml before tagging."
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Authenticate to GCP
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ env.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.GCP_AR_LOCATION }}-docker.pkg.dev --quiet

      - name: Build and push image
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}"
          TAG="$BASE:deployment-v${VERSION}"
          docker build -t "$TAG" .
          docker push "$TAG"

  prompt-service:
    name: Push to Service (Production Environment)
    runs-on: ubuntu-latest
    needs: build-and-push
    steps:
      - name: Send POST request
        env:
          VERSION: ${{ needs.build-and-push.outputs.version }}
        run: |
          # Name and tag only; the registry path is supplied downstream.
          IMAGE_LABEL="${{ env.IMAGE_NAME }}:deployment-v${VERSION}"

          curl --fail --connect-timeout 10 --max-time 60 -X POST \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer ${{ secrets.PROD_ENV_WEBHOOK_SECRET }}" \
            -d "{\"version\":\"$VERSION\",\"image_label\":\"$IMAGE_LABEL\"}" \
            "${{ secrets.PROD_ENV_URL }}/webhooks/v1/add_honcho_version"