name: Deploy to Production

on:
  workflow_dispatch:
    inputs:
      release:
        description: 'Release tag to deploy (leave empty for latest)'
        required: false
        default: ''

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Get release version
        id: get-release
        run: |
          if [ -z "${{ github.event.inputs.release }}" ]; then
            RELEASE=$(curl -s -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
              "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases?limit=1" | jq -r '.[0].tag_name')
          else
            RELEASE="${{ github.event.inputs.release }}"
          fi
          echo "RELEASE=$RELEASE" >> $GITHUB_OUTPUT
          echo "Release: $RELEASE"

      - name: Download release artifact
        run: |
          mkdir -p artifacts
          RELEASE="${{ steps.get-release.outputs.RELEASE }}"

          # Get release info
          RELEASE_INFO=$(curl -s -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/$RELEASE")

          ARTIFACT_ID=$(echo "$RELEASE_INFO" | jq -r '.assets[0].id')

          # Download artifact
          curl -L -o artifacts/oms-wms-erp.tar.gz \
            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/assets/$ARTIFACT_ID"

          ls -lh artifacts/

      - name: Verify artifact
        run: |
          cd artifacts
          # Download and verify checksum if available
          CHECKSUM_FILE=$(curl -s -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/${{ steps.get-release.outputs.RELEASE }}" | jq -r '.assets[] | select(.name == "RELEASE_CHECKSUM.txt") | .url')

          if [ ! -z "$CHECKSUM_FILE" ]; then
            curl -L -o CHECKSUM.txt "$CHECKSUM_FILE"
            sha256sum -c CHECKSUM.txt || exit 1
          fi

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts

      - name: Deploy to server
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          RELEASE: ${{ steps.get-release.outputs.RELEASE }}
        run: |
          ssh -i ~/.ssh/deploy_key ${DEPLOY_USER}@${DEPLOY_HOST} << 'DEPLOY_SCRIPT'

          # Create deployment directory
          DEPLOY_DIR="/home/kjh2064/deployments/oms-wms-erp_$(date +%Y%m%d_%H%M%S)"
          mkdir -p "$DEPLOY_DIR"

          # Upload artifact
          cd "$DEPLOY_DIR"

          # Extract artifact from temp location
          tar -xzf ~/artifacts-${{ github.run_id }}/oms-wms-erp.tar.gz

          # Install dependencies
          npm install --legacy-peer-deps --production

          # Copy environment file
          cp .env.example .env.production

          # Set permissions
          chmod -R 755 dist/
          chmod -R 755 node_modules/

          # Update active symlink
          cd /home/kjh2064
          rm -f oms-wms-erp_active
          ln -s "$DEPLOY_DIR" oms-wms-erp_active

          # Restart service
          sudo systemctl restart oms-wms-erp.service

          echo "✅ Deployment complete"
          echo "Active version: $(readlink oms-wms-erp_active)"

          DEPLOY_SCRIPT

      - name: Health check
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
        run: |
          ssh -i ~/.ssh/deploy_key ${DEPLOY_USER}@${DEPLOY_HOST} << 'HEALTH_CHECK'

          echo "Waiting for service to be ready..."
          sleep 5

          # Check service status
          if sudo systemctl is-active --quiet oms-wms-erp.service; then
            echo "✅ Service is active"
          else
            echo "❌ Service is not active"
            sudo journalctl -u oms-wms-erp.service -n 20
            exit 1
          fi

          # Check HTTP response
          if curl -s http://127.0.0.1:5173/ > /dev/null; then
            echo "✅ HTTP 200 response"
          else
            echo "❌ HTTP request failed"
            exit 1
          fi

          # Check logs for errors
          if sudo journalctl -u oms-wms-erp.service -n 50 | grep -i "error"; then
            echo "⚠️ Errors found in logs"
          else
            echo "✅ No errors in logs"
          fi

          echo "✅ Health check passed"

          HEALTH_CHECK

      - name: Deployment notification
        if: success()
        run: |
          echo "🚀 Deployment Successful"
          echo "Release: ${{ steps.get-release.outputs.RELEASE }}"
          echo "Status: Production deployment complete"

      - name: Rollback on failure
        if: failure()
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
        run: |
          ssh -i ~/.ssh/deploy_key ${DEPLOY_USER}@${DEPLOY_HOST} << 'ROLLBACK'

          echo "🔄 Rolling back to previous version..."

          cd /home/kjh2064
          PREVIOUS=$(ls -t oms-wms-erp_* | grep -v active | head -1)

          if [ ! -z "$PREVIOUS" ]; then
            rm -f oms-wms-erp_active
            ln -s "$PREVIOUS" oms-wms-erp_active
            sudo systemctl restart oms-wms-erp.service
            echo "✅ Rollback complete. Active version: $PREVIOUS"
          fi

          ROLLBACK