name: services/www - next/required

on:
  push:
    branches: [next]
    paths:
      - 'services/www/**'
      - 'packages/ui/**'
      - 'packages/stl/**'
      - 'packages/i18n/**'
      - '.github/workflows/services-www-next-required.yml'
      - 'pnpm-lock.yaml'
  workflow_dispatch:

concurrency:
  group: ci-www-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: read

jobs:
  setup-stage:
    name: Setup - Stage
    runs-on: ubuntu-latest
    outputs:
      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3

      - name: Setup Node.js with pnpm cache
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - name: Cache pnpm store
        id: cache-pnpm-store
        uses: actions/cache@v3
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

  build-configs:
    name: Build - Configs
    needs: setup-stage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build Rsbuild config
        run: pnpm --filter @ermnvldmr/rsbuild-config build
      - name: Build Storybook config
        run: pnpm --filter @ermnvldmr/storybook-config build
      - name: Upload Rsbuild Config
        uses: actions/upload-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
          retention-days: 1
      - name: Upload Storybook Config
        uses: actions/upload-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
          retention-days: 1
      - name: Build i18n package
        run: pnpm --filter @ermnvldmr/i18n build
      - name: Upload i18n dist
        uses: actions/upload-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
          retention-days: 1

  lint-www:
    name: Lint - WWW
    needs: build-configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Rsbuild Config
        uses: actions/download-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
      - name: Download i18n dist
        uses: actions/download-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
      - name: Download Storybook Config
        uses: actions/download-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
      - name: Lint WWW service
        run: pnpm --filter @ermnvldmr/www lint

  typecheck-www:
    name: Typecheck - WWW
    needs: build-configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Rsbuild Config
        uses: actions/download-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
      - name: Download i18n dist
        uses: actions/download-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
      - name: Download Storybook Config
        uses: actions/download-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
      - name: Typecheck WWW service
        run: pnpm --filter @ermnvldmr/www typecheck

  build-storybook:
    name: Build - Storybook
    needs: build-configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Rsbuild Config
        uses: actions/download-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
      - name: Download i18n dist
        uses: actions/download-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
      - name: Download Storybook Config
        uses: actions/download-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
      - name: Build WWW Storybook
        run: pnpm --filter @ermnvldmr/www build-storybook
      - name: Upload Storybook build
        uses: actions/upload-artifact@v4
        with:
          name: storybook-static
          path: services/www/storybook-static/
          retention-days: 1

  test-www:
    name: Test - Unit
    needs: build-configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Rsbuild Config
        uses: actions/download-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
      - name: Download i18n dist
        uses: actions/download-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
      - name: Download Storybook Config
        uses: actions/download-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
      - name: Test WWW service
        run: pnpm --filter @ermnvldmr/www test:coverage
      - name: Upload Unit coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./services/www/coverage/lcov.info
          flags: www
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  test-storybook:
    name: Test - Storybook
    needs: build-storybook
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Rsbuild Config
        uses: actions/download-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
      - name: Download i18n dist
        uses: actions/download-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
      - name: Download Storybook Config
        uses: actions/download-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
      - name: Install Playwright browsers
        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
      - name: Download Storybook build
        uses: actions/download-artifact@v4
        with:
          name: storybook-static
          path: services/www/storybook-static/
      - name: Serve Storybook and run tests with coverage
        run: pnpm --filter @ermnvldmr/www test:storybook:ci
      - name: Upload Storybook coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./services/www/coverage/storybook/lcov.info
          flags: www-storybook
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  build-www:
    name: Build - WWW Service
    needs: build-configs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Rsbuild Config
        uses: actions/download-artifact@v4
        with:
          name: rsbuild-config-dist
          path: packages/rsbuild-config/dist
      - name: Download i18n dist
        uses: actions/download-artifact@v4
        with:
          name: i18n-dist
          path: packages/i18n/dist
      - name: Download Storybook Config
        uses: actions/download-artifact@v4
        with:
          name: storybook-config-dist
          path: packages/storybook-config/dist
      - name: Build WWW service (all locales)
        run: pnpm --filter @ermnvldmr/www build:all
        env:
          RSDOCTOR: 'true'
      - name: Upload Rsdoctor report
        uses: actions/upload-artifact@v4
        with:
          name: rsdoctor-report
          path: services/www/rsdoctor/
          retention-days: 30

  build-docker:
    name: Build - Docker Image
    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      short_sha: ${{ steps.vars.outputs.short_sha }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Calculate Short SHA
        id: vars
        run: |
          SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ci/docker/www/Dockerfile
          push: true
          tags: ghcr.io/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha }}
          build-args: |
            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
            VERSION=${{ steps.vars.outputs.short_sha }}

  release-tag-docker:
    name: Release - Tag & Docker
    needs: build-docker
    runs-on: ubuntu-latest
    environment: services-www-releases-publish
    permissions:
      contents: write
      packages: write
    outputs:
      version: ${{ steps.calver.outputs.version }}
      short_sha: ${{ needs.build-docker.outputs.short_sha }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Calculate CalVer Version
        id: calver
        run: |
          VERSION=$(bash ci/scripts/calver-release.sh)
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Create and Push Tag
        run: |
          TAG_NAME="${{ steps.calver.outputs.version }}"
          git tag "$TAG_NAME"
          git push origin "$TAG_NAME"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Tag and Push Release Docker Image
        run: |
          docker buildx imagetools create \
            ghcr.io/${{ github.repository }}/www:${{ needs.build-docker.outputs.short_sha }} \
            --tag ghcr.io/${{ github.repository }}/www:${{ steps.calver.outputs.version }}

  deploy:
    name: Deploy - Kubernetes (GitOps)
    needs: release-tag-docker
    runs-on: ubuntu-latest
    environment:
      name: services-www-releases-deploy
      url: https://ermnvldmr.com
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: next
          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Setup Kustomize
        uses: imranismail/setup-kustomize@v2
        with:
          kustomize-version: "5.3.0"

      - name: Deploy via GitOps
        run: |
          WWW_TAG="${{ needs.release-tag-docker.outputs.short_sha }}"
          bash ci/scripts/deploy-gitops.sh www "${WWW_TAG}"

  verify-rollout:
    name: Verify - Production Rollout
    needs: [release-tag-docker, deploy]
    runs-on: ubuntu-latest
    steps:
      - name: Await production rollout
        run: |
          TARGET_COMMIT="${{ needs.release-tag-docker.outputs.short_sha }}"
          ENDPOINT="https://www.ermnvldmr.com/version.json"

          echo "========================================================"
          echo "Verifying production deployment on $ENDPOINT"
          echo "Expected commit:  $TARGET_COMMIT"
          echo "========================================================"

          MAX_ATTEMPTS=45
          ATTEMPT=1

          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."

            RESPONSE=$(curl -sfL --max-time 10 -H "User-Agent: GitHub-Actions-Rollout-Verifier" "$ENDPOINT" 2>/dev/null || true)

            if [ -n "$RESPONSE" ]; then
              LIVE_COMMIT=$(echo "$RESPONSE" | jq -r '.commit // empty')

              echo "  Live commit:  ${LIVE_COMMIT:-<none>}"

              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
                echo "✅ Success! Production has successfully rolled out $TARGET_COMMIT."
                exit 0
              fi
            else
              echo "  Endpoint did not return valid JSON or timed out."
            fi

            ATTEMPT=$((ATTEMPT + 1))
            sleep 10
          done

          echo "❌ Deployment verification timed out after 7.5 minutes."
          exit 1