name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  smoke-test:
    runs-on: ubuntu-latest

    steps:
      - name: Clone repository from Gitea
        run: |
          set -eu
          git clone http://gitea:3000/Mike/devops-platform.git .
          git checkout "${GITHUB_SHA}"

      - name: Run smoke tests
        run: python3 scripts/smoke_test.py

      - name: Login to Docker Hub
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          echo "$DOCKERHUB_TOKEN" | docker login \
            -u "$DOCKERHUB_USERNAME" \
            --password-stdin

      - name: Build Docker image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          docker build \
            -t mikhaillobanov/devops-platform:latest \
            -t mikhaillobanov/devops-platform:${GITHUB_SHA} \
            .

      - name: Scan Docker image with Trivy
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$HOME/.cache/trivy:/root/.cache/" \
            aquasec/trivy:0.76.0 image \
            --scanners vuln \
            --severity HIGH,CRITICAL \
            --ignore-unfixed \
            --skip-db-update \
            --exit-code 1 \
            mikhaillobanov/devops-platform:${GITHUB_SHA} 

      - name: Push Docker image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          docker push mikhaillobanov/devops-platform:latest
          docker push mikhaillobanov/devops-platform:${GITHUB_SHA}

      - name: Deploy via Ansible
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          ID_RSA: ${{ secrets.ID_RSA }}
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "$ID_RSA" | tr -d '\r' > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa root@87.242.118.200 \
            "cd /root/devops-platform && ansible-playbook -i ansible/inventory.ini ansible/playbooks/deploy_app.yml -e image_tag=${GITHUB_SHA}"