# release.yaml — production release on git tag vX.Y.Z.
# Promotes the image already on stage to prod, gated by manual sign-off.
name: release

on:
  push:
    tags: ['v*.*.*']

jobs:
  promote:
    runs-on: docker
    environment:
      name: production           # Gitea Environments — requires sign-off per branch protection
      url: https://breakpilot.com
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: extract version
        id: v
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: verify stage soak (>= 24h on this image)
        run: |
          IMG=registry.breakpilot.com/${{ github.event.repository.name }}:env-stage
          SOAK_SECONDS=$(orca image-age --env=stage --image $IMG)
          if [ "$SOAK_SECONDS" -lt 86400 ]; then
            echo "Stage soak only $SOAK_SECONDS s, < 24h. Aborting."
            exit 1
          fi
        env:
          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}

      - name: re-tag image as semver + env-prod
        uses: docker/login-action@v3
        with:
          registry: registry.breakpilot.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_PASS }}

      - run: |
          IMG=registry.breakpilot.com/${{ github.event.repository.name }}
          docker pull $IMG:env-stage
          docker tag  $IMG:env-stage $IMG:v${{ steps.v.outputs.version }}
          docker tag  $IMG:env-stage $IMG:env-prod
          docker push $IMG:v${{ steps.v.outputs.version }}
          docker push $IMG:env-prod

      - name: deploy to prod
        run: orca apply --env=prod --image-tag=v${{ steps.v.outputs.version }}
        env:
          ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}

      - name: post-deploy smoke
        run: orca exec --env=prod smoke-runner

      - name: generate release notes from conventional commits
        uses: orhun/git-cliff-action@v3
        with:
          config: cliff.toml
          args: --latest --strip header
        env:
          OUTPUT: RELEASE_NOTES.md

      - name: create Gitea release
        run: |
          curl -X POST -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "$(jq -Rs '{tag_name:"v${{ steps.v.outputs.version }}", name:"v${{ steps.v.outputs.version }}", body:.}' < RELEASE_NOTES.md)" \
            https://gitea.meghsakha.com/api/v1/repos/${{ github.repository }}/releases

  rollback-on-failure:
    needs: promote
    if: failure()
    runs-on: docker
    steps:
      - name: orca rollback prod
        run: orca rollout undo ${{ github.event.repository.name }} --env=prod
        env:
          ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
      - name: page on-call
        run: |
          curl -X POST -H "Content-Type: application/json" \
            -d '{"text":"Release of ${{ github.event.repository.name }} ${{ github.ref }} FAILED. Rolled back. See Gitea Actions run."}' \
            ${{ secrets.ONCALL_WEBHOOK }}