name: CD Production

# Pipeline de production — Hetzner k3s (infra/prod/).
#
# Enchaînement : qualité → vérification → promotion/rebuild → déploiement → contrôle
#
# TROIS RÈGLES STRUCTURANTES
#
# 1. Le BACKEND est PROMU depuis la preprod, jamais reconstruit.
#    Promouvoir garantit que le binaire déployé en production est exactement
#    celui qui a passé la chaîne de preprod (lint, tests unitaires, tests
#    d'intégration, build). Un rebuild casserait cette garantie.
#
# 2. Le FRONTEND est RECONSTRUIT pour la production.
#    next.config.js fige NEXT_PUBLIC_API_URL au moment du build. Promouvoir
#    l'image de preprod livrerait une application qui appelle
#    api.preprod.xpeditis.com en production. C'est la raison pour laquelle ce
#    workflow ne peut pas se contenter de re-taguer.
#
# 3. Le déploiement passe par SSH, pas par l'API Kubernetes.
#    L'API k3s (6443) n'est ouverte qu'aux IP d'administration. Les runners
#    GitHub n'ont pas d'IP fixe : le job ouvre le port 22 pour la seule IP du
#    runner via un firewall Hetzner dédié, puis le referme systématiquement.
#
# Secrets et variables : voir infra/prod/env/github-secrets.md

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      tag:
        description: "SHA court à déployer (laisser vide = HEAD de main)"
        required: false

concurrency:
  group: cd-production
  cancel-in-progress: false

permissions:
  contents: read

env:
  REGISTRY: rg.fr-par.scw.cloud/weworkstudio
  NODE_VERSION: '20'
  K8S_NAMESPACE: xpeditis-prod

jobs:
  # ═══ 1. Qualité ══════════════════════════════════════════════════════════
  backend-quality:
    name: Backend — Lint
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/backend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: apps/backend/package-lock.json
      - run: npm install --legacy-peer-deps
      - run: npm run lint

  frontend-quality:
    name: Frontend — Lint & Type-check
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: apps/frontend/package-lock.json
      - run: npm ci --legacy-peer-deps
      - run: npm run lint
      - run: npm run type-check

  backend-tests:
    name: Backend — Tests unitaires
    runs-on: ubuntu-latest
    needs: backend-quality
    defaults:
      run:
        working-directory: apps/backend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: apps/backend/package-lock.json
      - run: npm install --legacy-peer-deps
      - run: npm test -- --passWithNoTests

  frontend-tests:
    name: Frontend — Tests unitaires
    runs-on: ubuntu-latest
    needs: frontend-quality
    defaults:
      run:
        working-directory: apps/frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: apps/frontend/package-lock.json
      - run: npm ci --legacy-peer-deps
      - run: npm test -- --passWithNoTests

  # ═══ 2. Vérification de la provenance ════════════════════════════════════
  # Si l'image preprod-SHA n'existe pas, c'est que ce commit n'est jamais passé
  # par la chaîne de preprod. Le déploiement est alors bloqué net.
  verify-image:
    name: Vérifier l'image de preprod
    runs-on: ubuntu-latest
    needs: [backend-tests, frontend-tests]
    outputs:
      sha: ${{ steps.sha.outputs.short }}
    steps:
      - name: SHA court
        id: sha
        run: |
          RAW="${{ github.event.inputs.tag }}"
          [ -n "$RAW" ] || RAW="${{ github.sha }}"
          echo "short=$(echo "$RAW" | cut -c1-7)" >> $GITHUB_OUTPUT

      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Image backend preprod-SHA présente
        run: |
          TAG="${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}"
          docker buildx imagetools inspect "$TAG" || {
            echo "::error::$TAG introuvable. Ce commit n'a pas été construit par la chaîne de preprod."
            echo "Fusionnez d'abord sur preprod et attendez que le pipeline passe au vert."
            exit 1
          }

      - name: Image log-exporter preprod-SHA présente
        run: |
          TAG="${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${{ steps.sha.outputs.short }}"
          docker buildx imagetools inspect "$TAG" || {
            echo "::error::$TAG introuvable."
            exit 1
          }

  # ═══ 3a. Promotion du backend (aucun rebuild) ════════════════════════════
  promote-backend:
    name: Promouvoir le backend
    runs-on: ubuntu-latest
    needs: verify-image
    steps:
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}
      - name: preprod-SHA → prod-SHA
        run: |
          SHA="${{ needs.verify-image.outputs.sha }}"
          # Opération au niveau du manifeste : aucune couche n'est retransférée,
          # le condensat de l'image reste identique à celui validé en preprod.
          docker buildx imagetools create \
            --tag ${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA} \
            --tag ${{ env.REGISTRY }}/xpeditis-backend:latest \
            ${{ env.REGISTRY }}/xpeditis-backend:preprod-${SHA}
          docker buildx imagetools create \
            --tag ${{ env.REGISTRY }}/xpeditis-log-exporter:prod-${SHA} \
            --tag ${{ env.REGISTRY }}/xpeditis-log-exporter:latest \
            ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${SHA}

  # ═══ 3b. Reconstruction du frontend avec les URLs de production ══════════
  build-frontend:
    name: Reconstruire le frontend (URLs de production)
    runs-on: ubuntu-latest
    needs: verify-image
    steps:
      - uses: actions/checkout@v4
        with:
          # On construit EXACTEMENT le commit vérifié, pas HEAD.
          ref: ${{ github.sha }}
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: nologin
          password: ${{ secrets.REGISTRY_TOKEN }}
      - uses: docker/build-push-action@v5
        with:
          context: ./apps/frontend
          file: ./apps/frontend/Dockerfile
          push: true
          platforms: linux/amd64
          tags: |
            ${{ env.REGISTRY }}/xpeditis-frontend:prod-${{ needs.verify-image.outputs.sha }}
            ${{ env.REGISTRY }}/xpeditis-frontend:latest
          cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod
          cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod,mode=max
          build-args: |
            NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL_PROD }}
            NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL_PROD }}

      - name: Contrôle — l'URL de preprod ne doit pas figurer dans le bundle
        run: |
          IMAGE="${{ env.REGISTRY }}/xpeditis-frontend:prod-${{ needs.verify-image.outputs.sha }}"
          CID=$(docker create "$IMAGE")
          docker cp "$CID:/app/.next" /tmp/next-check 2>/dev/null || true
          docker rm "$CID" >/dev/null
          if grep -rq "api.preprod.xpeditis.com" /tmp/next-check 2>/dev/null; then
            echo "::error::L'URL de preprod est figée dans le bundle de production."
            echo "Vérifiez le secret NEXT_PUBLIC_API_URL_PROD."
            exit 1
          fi
          echo "Aucune URL de preprod dans le bundle."

  # ═══ 4. Déploiement ══════════════════════════════════════════════════════
  deploy:
    name: Déployer en production
    runs-on: ubuntu-latest
    needs: [verify-image, promote-backend, build-frontend]
    # Environnement protégé : activez « Required reviewers » pour exiger une
    # validation humaine avant toute mise en production.
    environment:
      name: production
      url: https://app.xpeditis.com
    steps:
      - uses: actions/checkout@v4

      - name: Installer le client Hetzner
        run: |
          curl -fsSL https://github.com/hetznercloud/cli/releases/download/v1.49.0/hcloud-linux-amd64.tar.gz \
            | tar -xz -C /tmp hcloud
          sudo install -m 0755 /tmp/hcloud /usr/local/bin/hcloud
          hcloud version

      - name: Ouvrir le port 22 pour l'IP de ce runner
        env:
          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
        run: |
          RUNNER_IP="$(curl -fsS --max-time 10 https://ifconfig.me)"
          echo "IP du runner : ${RUNNER_IP}"
          cat > /tmp/fw-open.json <<JSON
          [{
            "direction": "in",
            "protocol": "tcp",
            "port": "22",
            "source_ips": ["${RUNNER_IP}/32"],
            "description": "GitHub Actions run ${{ github.run_id }}"
          }]
          JSON
          hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-open.json

      - name: Préparer SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          echo "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          # Empreinte épinglée : un détournement DNS ou BGP ne peut pas
          # rediriger le déploiement vers une machine tierce.
          echo "${{ secrets.PROD_SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - name: Synchroniser infra/prod sur le serveur
        run: |
          rsync -az --delete \
            --exclude '.terraform' --exclude '*.tfstate*' --exclude '*.tfvars' \
            -e "ssh -o StrictHostKeyChecking=yes -i ~/.ssh/id_ed25519" \
            infra/prod/ \
            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}:/opt/xpeditis/infra-prod/"

      - name: Déployer
        id: deploy
        run: |
          SHA="${{ needs.verify-image.outputs.sha }}"
          ssh -o StrictHostKeyChecking=yes -i ~/.ssh/id_ed25519 \
            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
            "deploy prod-${SHA}"

      - name: Tests de fumée depuis l'extérieur
        env:
          PROD_API_URL: ${{ vars.PROD_API_URL }}
          PROD_APP_URL: ${{ vars.PROD_APP_URL }}
        run: bash infra/prod/scripts/smoke-test.sh

      - name: Retour arrière si le déploiement a échoué
        if: failure() && steps.deploy.conclusion == 'failure'
        run: |
          ssh -o StrictHostKeyChecking=yes -i ~/.ssh/id_ed25519 \
            "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
            "rollback" || true

      - name: Refermer le firewall
        # `always()` : la fenêtre d'exposition se referme même si le
        # déploiement a échoué, si le job a été annulé ou s'il a expiré.
        if: always()
        env:
          HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
        run: |
          echo '[]' > /tmp/fw-close.json
          hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-close.json
          echo "Firewall CI refermé."

      - name: Effacer la clé SSH
        if: always()
        run: shred -u ~/.ssh/id_ed25519 2>/dev/null || rm -f ~/.ssh/id_ed25519

  # ═══ 5. Notifications ════════════════════════════════════════════════════
  notify-success:
    name: Notifier le succès
    runs-on: ubuntu-latest
    needs: [verify-image, deploy]
    if: success()
    steps:
      - run: |
          curl -sf -H "Content-Type: application/json" -d '{
            "embeds": [{
              "title": "Production déployée et saine",
              "color": 3066993,
              "fields": [
                {"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
                {"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true},
                {"name": "Cible", "value": "Hetzner k3s — xpeditis-prod", "inline": false},
                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
              ],
              "footer": {"text": "Xpeditis CI/CD - Production"}
            }]
          }' ${{ secrets.DISCORD_WEBHOOK_URL }}

  notify-failure:
    name: Notifier l'échec
    runs-on: ubuntu-latest
    needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, promote-backend, build-frontend, deploy]
    if: failure()
    steps:
      - run: |
          curl -sf -H "Content-Type: application/json" -d '{
            "content": "@here ECHEC DU PIPELINE DE PRODUCTION",
            "embeds": [{
              "title": "Pipeline de production en échec",
              "description": "Un retour arrière a été tenté si l échec est survenu pendant le déploiement. Vérifiez l état réel avant toute nouvelle tentative.",
              "color": 15158332,
              "fields": [
                {"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
                {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false},
                {"name": "A vérifier", "value": "Le firewall CI est-il bien refermé ? `hcloud firewall describe xpeditis-prod-fw-cicd`", "inline": false}
              ],
              "footer": {"text": "Xpeditis CI/CD - Production"}
            }]
          }' ${{ secrets.DISCORD_WEBHOOK_URL }}