name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  smoke-test:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository from Gitea
        run: |
          set -eu
          git clone http://gitea:3000/Mike/devops-platform.git .
          git checkout "${GITHUB_SHA}"

      - name: Run smoke tests
        run: python3 scripts/smoke_test.py

      - name: Install Docker CLI
        run: |
          apt-get update
          apt-get install -y docker.io

      - name: Login to Docker Hub
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          echo "$DOCKERHUB_TOKEN" | docker login \
            -u "$DOCKERHUB_USERNAME" \
            --password-stdin

      - name: Build Docker image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          docker build \
            -t mikhaillobanov/devops-platform:latest \
            -t mikhaillobanov/devops-platform:${GITHUB_SHA} \
            .

      - name: Scan Docker image with Trivy
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$HOME/.cache/trivy:/root/.cache/" \
            aquasec/trivy:0.76.0 image \
            --scanners vuln \
            --severity HIGH,CRITICAL \
            --ignore-unfixed \
            --exit-code 1 \
            mikhaillobanov/devops-platform:${GITHUB_SHA}

      - name: Push Docker image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          docker push mikhaillobanov/devops-platform:latest
          docker push mikhaillobanov/devops-platform:${GITHUB_SHA}

      - name: Deploy application via Ansible
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          ANSIBLE_PRIVATE_KEY: ${{ secrets.ID_RSA }}
          IMAGE: mikhaillobanov/devops-platform:${{ github.sha }}
        run: |
          set -eu

          apt-get update
          apt-get install -y ansible openssh-client

          mkdir -p /root/.ssh
          chmod 700 /root/.ssh

          printf '%s\n' "$ANSIBLE_PRIVATE_KEY" > /root/.ssh/id_rsa
          chmod 600 /root/.ssh/id_rsa

          ssh-keyscan -H 178.154.209.109 >> /root/.ssh/known_hosts
          chmod 600 /root/.ssh/known_hosts

          ansible-playbook \
            -i ansible/inventory.ini \
            ansible/playbooks/deploy_app.yml \
            -e "deploy_image=$IMAGE"