# Gitea Actions: Aggregate openapi.yaml specs + trigger docs-site build
# Closes leeworks-agents/api-company#10

name: Build Docs Site

on:
  push:
    branches: [main]
  workflow_dispatch:
  schedule:
    # Re-build daily at 02:00 UTC to pick up spec changes
    - cron: '0 2 * * *'

jobs:
  aggregate-specs:
    name: Aggregate OpenAPI Specs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout api-company
        uses: actions/checkout@v4
        with:
          path: api-company

      # NOTE: cross-repo checkouts use SIBLING_REPOS_TOKEN, NOT the auto-injected
      # GITEA_TOKEN. Gitea's automatic GITEA_TOKEN is scoped to THIS repo only,
      # so checking out other repos fails with
      # "Determining the default branch → not found". GITEA_TOKEN is also a
      # reserved secret name that cannot be overridden, hence a separate secret.
      # SIBLING_REPOS_TOKEN must be a PAT with read access to the API repos.
      - name: Checkout zip-enrichment
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/zip-enrichment
          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: zip-enrichment

      - name: Checkout holidays
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/holidays
          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: holidays

      - name: Checkout air-quality
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/air-quality
          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: air-quality

      - name: Checkout vin-decoder
        uses: actions/checkout@v4
        with:
          repository: leeworks-agents/vin-decoder
          token: ${{ secrets.SIBLING_REPOS_TOKEN }}
          path: vin-decoder

      - name: Copy openapi.yaml specs into docs-site
        run: |
          mkdir -p api-company/docs-site/public/specs
          cp zip-enrichment/openapi.yaml api-company/docs-site/public/specs/zip-enrichment.yaml
          cp holidays/openapi.yaml api-company/docs-site/public/specs/holidays.yaml
          cp air-quality/openapi.yaml api-company/docs-site/public/specs/air-quality.yaml
          cp vin-decoder/openapi.yaml api-company/docs-site/public/specs/vin-decoder.yaml
          echo "Specs copied:"
          ls -la api-company/docs-site/public/specs/

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install docs-site dependencies
        working-directory: api-company/docs-site
        run: npm ci

      - name: Build docs-site
        working-directory: api-company/docs-site
        run: npm run build

      - name: Install Docker CLI
        # The job container (node:20) ships no `docker` binary. The runner has a
        # dind daemon (dind.enabled in the runner HelmRelease), reachable via
        # DOCKER_HOST, so we only need the client. Install the static binary.
        env:
          DOCKER_CLI_VERSION: "27.3.1"
        run: |
          set -euxo pipefail
          curl -fSL --retry 5 --retry-delay 3 --retry-all-errors \
            -o /tmp/docker.tgz \
            "https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_CLI_VERSION}.tgz"
          tar -xzf /tmp/docker.tgz -C /tmp
          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
          docker version --format '{{.Client.Version}}'
          docker info >/dev/null   # confirms the dind daemon is reachable

      - name: Log in to container registry
        # Use Gitea's built-in container registry (gitea.leeworks.dev), which
        # has a valid Let's Encrypt cert. The standalone registry.leeworks.dev
        # serves Traefik's default self-signed cert and fails TLS verification.
        #
        # Auth uses REGISTRY_TOKEN, NOT the auto GITEA_TOKEN: the auto token has
        # no package-registry scope, and the registry requires the username to
        # match the token owner. REGISTRY_TOKEN must be a PAT (owner: 0xWheatyz)
        # with write:package + read:package scope.
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.leeworks.dev \
            -u 0xWheatyz --password-stdin

      - name: Build and push docs-site image
        working-directory: api-company/docs-site
        run: |
          IMAGE="gitea.leeworks.dev/leeworks-agents/docs-site"
          SHA="${{ gitea.sha }}"
          docker build -t "$IMAGE:$SHA" -t "$IMAGE:latest" .
          docker push "$IMAGE:$SHA"
          docker push "$IMAGE:latest"
          echo "Pushed $IMAGE:$SHA"

      - name: Trigger Flux reconcile (optional)
        run: |
          echo "Image pushed. Flux will detect new tag via image automation and re-deploy docs-site."
          echo "If image automation is not configured, manually run: flux reconcile helmrelease docs-site -n docs-site"