clone:
  git:
    image: woodpeckerci/plugin-git

steps:
  - name: build-and-push
    image: gcr.io/kaniko-project/executor:v1.23.2-debug
    environment:
      ZOT_USERNAME:
        from_secret: ZOT_USERNAME
      ZOT_PASSWORD:
        from_secret: ZOT_PASSWORD
    commands:
      - mkdir -p /kaniko/.docker
      # Authenticate kaniko against the zot registry. The username:password
      # pair is base64-encoded into the Docker config.json auth field.
      - >-
        printf '{"auths":{"registry.be.kaien.ru":{"auth":"%s"}}}'
        "$(printf '%s:%s' "$ZOT_USERNAME" "$ZOT_PASSWORD" | base64 | tr -d '\n')"
        > /kaniko/.docker/config.json
      # Publish an immutable per-commit tag (full CI_COMMIT_SHA) as the
      # primary tag, plus :latest as a convenience alias. The version baked
      # into the binary via ldflags matches the SHA. Kaniko pushes both in
      # one build.
      - >-
        /kaniko/executor
        --context "$CI_WORKSPACE"
        --dockerfile "$CI_WORKSPACE/Dockerfile"
        --build-arg VERSION=$CI_COMMIT_SHA
        --destination "registry.be.kaien.ru/woodpecker_mcp/woodpecker_mcp:$CI_COMMIT_SHA"
        --destination "registry.be.kaien.ru/woodpecker_mcp/woodpecker_mcp:latest"
    when:
      - branch: master
        event: [push, manual]

  - name: deploy
    image: alpine:latest
    entrypoint: ["/bin/sh", "-c", 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/woodpecker-script.sh && exec /bin/sh -e /tmp/woodpecker-script.sh']
    environment:
      SSH_PRIVATE_KEY:
        from_secret: SSH_PRIVATE_KEY
      DEPLOY_HOST:
        from_secret: DEPLOY_HOST
      DEPLOY_USER:
        from_secret: DEPLOY_USER
      ZOT_USERNAME:
        from_secret: ZOT_USERNAME
      ZOT_PASSWORD:
        from_secret: ZOT_PASSWORD
    commands:
      - apk add --no-cache openssh-client gettext
      - eval $(ssh-agent -s)
      - mkdir -p ~/.ssh && chmod 700 ~/.ssh
      - echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-add ~/.ssh/id_rsa
      - ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
      - chmod 644 ~/.ssh/known_hosts
      - echo "$ZOT_PASSWORD" | ssh $DEPLOY_USER@$DEPLOY_HOST "docker login registry.be.kaien.ru -u $ZOT_USERNAME --password-stdin"
      # Pull the immutable SHA tag (also verifies it exists in the registry).
      - ssh -n $DEPLOY_USER@$DEPLOY_HOST "docker pull registry.be.kaien.ru/woodpecker_mcp/woodpecker_mcp:$CI_COMMIT_SHA"
      - ssh $DEPLOY_USER@$DEPLOY_HOST "kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f -" < woodpecker-mcp-sealed.yaml
      # Render placeholders (incl. CI_COMMIT_SHA) via the existing envsubst flow
      # and apply. The image string now changes every commit, so kubectl apply
      # alone triggers a rollout — no manual rollout restart needed.
      - envsubst < k8s-deploy.yaml | ssh $DEPLOY_USER@$DEPLOY_HOST "kubectl --kubeconfig /etc/kubernetes/admin.conf apply -f -"
      - ssh -n $DEPLOY_USER@$DEPLOY_HOST "kubectl --kubeconfig /etc/kubernetes/admin.conf -n mcp-servers rollout status deployment/woodpecker-mcp --timeout=120s"
      - ssh -n $DEPLOY_USER@$DEPLOY_HOST "docker image prune -f"
    depends_on:
      - build-and-push
    when:
      - branch: master
        event: [push, manual]