name: Deploy Production

on:
  push:
    tags:
      - 'v*'
  release:
    types:
      - published
  workflow_dispatch:

jobs:
  deploy-frontend:
    if: github.event_name != 'release' || startsWith(github.event.release.tag_name, 'v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          run_install: false
          package_json_path: package.json

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build frontend
        run: pnpm --filter=@my-roadtrip/web build
        env:
          VITE_API_URL: ${{ secrets.PRODUCTION_API_URL }}
          VITE_FIREBASE_API_KEY: ${{ secrets.PRODUCTION_FIREBASE_API_KEY }}
          VITE_FIREBASE_AUTH_DOMAIN: ${{ secrets.PRODUCTION_FIREBASE_AUTH_DOMAIN }}
          VITE_FIREBASE_PROJECT_ID: ${{ secrets.PRODUCTION_FIREBASE_PROJECT_ID }}
          VITE_FIREBASE_STORAGE_BUCKET: ${{ secrets.PRODUCTION_FIREBASE_STORAGE_BUCKET }}
          VITE_FIREBASE_MESSAGING_SENDER_ID: ${{ secrets.PRODUCTION_FIREBASE_MESSAGING_SENDER_ID }}
          VITE_FIREBASE_APP_ID: ${{ secrets.PRODUCTION_FIREBASE_APP_ID }}
          VITE_FIREBASE_MEASUREMENT_ID: ${{ secrets.PRODUCTION_FIREBASE_MEASUREMENT_ID }}
          VITE_GOOGLE_MAPS_API_KEY: ${{ secrets.PRODUCTION_GOOGLE_MAPS_API_KEY }}
          VITE_MAPBOX_TOKEN: ${{ secrets.PRODUCTION_MAPBOX_TOKEN }}

      - name: Deploy Firestore rules and indexes
        env:
          FIREBASE_SERVICE_ACCOUNT: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
        run: |
          printf '%s' "$FIREBASE_SERVICE_ACCOUNT" > "${HOME}/firebase-service-account.json"
          export GOOGLE_APPLICATION_CREDENTIALS="${HOME}/firebase-service-account.json"
          npx firebase-tools deploy --only firestore:rules,firestore:indexes --project deuxdegamelife --non-interactive

      - name: Deploy to Firebase Hosting (production)
        uses: FirebaseExtended/action-hosting-deploy@v0
        with:
          repoToken: '${{ secrets.GITHUB_TOKEN }}'
          firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT }}'
          projectId: deuxdegamelife
          target: production

  deploy-backend:
    if: github.event_name != 'release' || startsWith(github.event.release.tag_name, 'v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: google-github-actions/auth@v2
        with:
          credentials_json: '${{ secrets.GCP_SA_KEY }}'

      - uses: google-github-actions/setup-gcloud@v2

      - name: Build and push to GCR
        run: |
          gcloud builds submit \
            --config=cloudbuild.yaml \
            --substitutions=SHORT_SHA=${GITHUB_SHA::7}

      - name: Deploy to Cloud Run (production)
        run: |
          gcloud run deploy myroadtrip-api-production \
            --image=gcr.io/${{ secrets.GCP_PROJECT_ID }}/myroadtrip-api:${GITHUB_SHA::7} \
            --region=europe-west1 \
            --platform=managed \
            --allow-unauthenticated \
            --set-env-vars=NODE_ENV=production \
            --set-secrets=FIREBASE_PRIVATE_KEY=firebase-private-key:latest \
            --set-secrets=OPENAI_API_KEY=openai-api-key:latest \
            --min-instances=1 \
            --max-instances=20 \
            --memory=1Gi \
            --cpu=2
