name: TaxBaik CI/CD

on:
  push:
    branches:
      - master

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0'

      - name: Restore dependencies
        run: dotnet restore TaxBaik.sln

      - name: Build solution
        run: |
          dotnet clean TaxBaik.sln -c Release
          dotnet build TaxBaik.sln -c Release --no-restore

      - name: Test solution
        run: dotnet test TaxBaik.sln -c Release --no-build

      - name: Publish Web
        run: dotnet publish TaxBaik.Web/ -c Release -o ./publish --no-restore

      - name: Publish Proxy
        run: dotnet publish TaxBaik.Proxy/ -c Release -o ./publish/proxy

      - name: Write production secrets
        run: |
          set -e
          JWT_SECRET_KEY="${{ secrets.TAXBAIK_JWT_SECRET_KEY }}"
          TELEGRAM_BOT_TOKEN="${{ secrets.TAXBAIK_TELEGRAM_BOT_TOKEN }}"
          TELEGRAM_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_CHAT_ID }}"
          TELEGRAM_INQUIRY_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_INQUIRY_CHAT_ID }}"
          TELEGRAM_SYSTEM_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_SYSTEM_CHAT_ID }}"
          [ -z "$JWT_SECRET_KEY" ]        && { echo "Missing TAXBAIK_JWT_SECRET_KEY" >&2;        exit 1; }
          [ -z "$TELEGRAM_BOT_TOKEN" ]    && { echo "Missing TAXBAIK_TELEGRAM_BOT_TOKEN" >&2;    exit 1; }
          [ -z "$TELEGRAM_CHAT_ID" ]      && { echo "Missing TAXBAIK_TELEGRAM_CHAT_ID" >&2;      exit 1; }
          [ -z "$TELEGRAM_INQUIRY_CHAT_ID" ] && TELEGRAM_INQUIRY_CHAT_ID="$TELEGRAM_CHAT_ID"
          [ -z "$TELEGRAM_SYSTEM_CHAT_ID" ]  && TELEGRAM_SYSTEM_CHAT_ID="-5585148480"
          JWT_SECRET_KEY="$JWT_SECRET_KEY" \
          TELEGRAM_BOT_TOKEN="$TELEGRAM_BOT_TOKEN" \
          TELEGRAM_CHAT_ID="$TELEGRAM_CHAT_ID" \
          TELEGRAM_INQUIRY_CHAT_ID="$TELEGRAM_INQUIRY_CHAT_ID" \
          TELEGRAM_SYSTEM_CHAT_ID="$TELEGRAM_SYSTEM_CHAT_ID" \
          python3 -c '
          import json, os, pathlib
          pathlib.Path("./publish/appsettings.Production.json").write_text(
            json.dumps({
              "Jwt":      {"SecretKey": os.environ["JWT_SECRET_KEY"]},
              "Telegram": {
                "BotToken": os.environ["TELEGRAM_BOT_TOKEN"],
                "ChatId": os.environ["TELEGRAM_CHAT_ID"],
                "InquiryChatId": os.environ["TELEGRAM_INQUIRY_CHAT_ID"],
                "SystemChatId": os.environ["TELEGRAM_SYSTEM_CHAT_ID"]
              }
            }, ensure_ascii=False, indent=2),
            encoding="utf-8"
          )'
          test -s ./publish/appsettings.Production.json || { echo "appsettings.Production.json is empty" >&2; exit 1; }

      - name: Verify proxy artifact
        run: |
          test -s ./publish/proxy/TaxBaik.Proxy.dll || { echo "TaxBaik.Proxy.dll missing" >&2; exit 1; }
          test -s ./publish/proxy/TaxBaik.Proxy.runtimeconfig.json || { echo "TaxBaik.Proxy.runtimeconfig.json missing" >&2; exit 1; }

      - name: Copy migrations
        run: cp -r db/migrations ./publish/migrations || true

      - name: Generate build info
        run: |
          COMMIT_HASH=$(git rev-parse --short HEAD)
          BUILD_TIME=$(date -u +'%Y-%m-%d %H:%M:%S UTC')
          mkdir -p ./publish/wwwroot
          printf '{\n  "version": "%s",\n  "built": "%s"\n}\n' "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json
          printf 'Version: %s\nBuilt: %s\n' "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.txt
          echo "✓ Build: $COMMIT_HASH @ $BUILD_TIME"

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
          SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
          if [ -n "$SSH_KEY_B64" ]; then
            printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
          elif [ -n "$SSH_KEY_RAW" ]; then
            if printf '%s' "$SSH_KEY_RAW" | grep -q 'BEGIN .*PRIVATE KEY'; then
              printf '%b\n' "$SSH_KEY_RAW" > ~/.ssh/id_ed25519
            else
              printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/id_ed25519
            fi
          else
            echo "Missing DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY" >&2; exit 1
          fi
          sed -i 's/\r$//' ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${{ secrets.DEPLOY_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Package artifact
        run: |
          cp deploy_gb.sh ./publish/deploy_gb.sh
          tar -czf taxbaik_deploy.tgz -C ./publish .
          echo "✓ Package: $(du -sh taxbaik_deploy.tgz | cut -f1)"

      - name: Deploy & verify on server
        run: |
          set -e
          export TAXBAIK_DEPLOY_FROM_CI=1
          TIMESTAMP=$(date +%Y%m%d_%H%M%S)
          COMMIT=$(git rev-parse --short HEAD)
          DEPLOY_HOST="${{ secrets.DEPLOY_HOST }}"
          DEPLOY_USER="${{ secrets.DEPLOY_USER }}"
          TELEGRAM_BOT_TOKEN="${{ secrets.TAXBAIK_TELEGRAM_BOT_TOKEN }}"
          TELEGRAM_SYSTEM_CHAT_ID="${{ secrets.TAXBAIK_TELEGRAM_SYSTEM_CHAT_ID }}"
          TELEGRAM_CHAT_ID="${TELEGRAM_SYSTEM_CHAT_ID:--5585148480}"

          send_telegram() {
            local text="$1"
            if [ -z "$TELEGRAM_BOT_TOKEN" ]; then
              echo "Skipping Telegram notification: missing TAXBAIK_TELEGRAM_BOT_TOKEN" >&2
              return 0
            fi

            curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
              -d "chat_id=${TELEGRAM_CHAT_ID}" \
              --data-urlencode "text=${text}" \
              -d "parse_mode=HTML" >/dev/null || true
          }

          notify_failure() {
            local exit_code=$?
            send_telegram "❌ <b>TaxBaik 배포 실패</b>

            커밋: <code>${COMMIT}</code>
            시간: <code>${TIMESTAMP}</code>
            단계: CI/CD deploy"
            exit "$exit_code"
          }

          trap notify_failure ERR

          echo "=== Deploying TaxBaik $COMMIT ($TIMESTAMP) ==="

          # 1. 아티팩트 업로드
          scp -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=yes \
            taxbaik_deploy.tgz "$DEPLOY_USER@$DEPLOY_HOST:/tmp/taxbaik_${TIMESTAMP}.tgz"

          # 2. 서버에서 배포 + 헬스 체크 (SSH 1회 연결로 처리, Green-Blue 지원)
          ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=yes \
              -o ServerAliveInterval=10 \
              "$DEPLOY_USER@$DEPLOY_HOST" TAXBAIK_DEPLOY_FROM_CI=1 bash << REMOTE
          set -e
          DEPLOY_HOME="/home/kjh2064"
          DEPLOY_DIR="\$DEPLOY_HOME/deployments/taxbaik_${TIMESTAMP}"
          TIMESTAMP="${TIMESTAMP}"

          echo "--- [1/5] 압축 해제 ---"
          mkdir -p "\$DEPLOY_DIR"
          tar -xzf "/tmp/taxbaik_\${TIMESTAMP}.tgz" -C "\$DEPLOY_DIR"
          rm -f "/tmp/taxbaik_\${TIMESTAMP}.tgz"

          echo "--- [2/5] 운영 설정 검증 ---"
          test -s "\$DEPLOY_DIR/appsettings.Production.json" \
            || { echo "FATAL: appsettings.Production.json 없음" >&2; exit 1; }
          test -s "\$DEPLOY_DIR/proxy/TaxBaik.Proxy.dll" \
            || { echo "FATAL: TaxBaik.Proxy.dll 없음" >&2; exit 1; }

          echo "--- [3/4] Green-Blue 배포 실행 ---"
          chmod +x "\$DEPLOY_DIR/deploy_gb.sh"
          "\$DEPLOY_DIR/deploy_gb.sh" "\$DEPLOY_DIR"

          echo "--- [5/5] 헬스 체크 (최대 60초) ---"
          ATTEMPTS=20
          for i in \$(seq 1 \$ATTEMPTS); do
            STATUS=\$(curl -sf -o /dev/null -w '%{http_code}' http://127.0.0.1:5001/taxbaik/ 2>/dev/null || echo "000")
            if [ "\$STATUS" = "200" ]; then
              echo "✓ [1/4] 메인 페이지 로드 완료"

              # 검증 1: CSS 파일 로드
              CSS_STATUS=\$(curl -sf -o /dev/null -w '%{http_code}' http://127.0.0.1:5001/taxbaik/css/admin.css 2>/dev/null || echo "000")
              if [ "\$CSS_STATUS" != "200" ]; then
                echo "❌ CSS 파일 로드 실패 (상태: \$CSS_STATUS)" >&2
                exit 1
              fi
              echo "✓ [2/4] CSS 파일 로드 완료"

              # 검증 2: 버전 정보
              if [ ! -s "\$DEPLOY_DIR/wwwroot/version.json" ]; then
                echo "❌ version.json 누락" >&2
                exit 1
              fi
              echo "✓ [3/4] 버전 정보 확인 완료"

              # 검증 4: 5001 프록시 확인
              if ! ss -tlnp | grep -q ':5001 '; then
                echo "❌ 5001 프록시가 실행 중이 아님" >&2
                exit 1
              fi
              echo "✓ [4/5] 5001 프록시 확인 완료"

              # 검증 5: 관리자 로그인 페이지
              LOGIN_STATUS=\$(curl -sf -o /dev/null -w '%{http_code}' http://127.0.0.1:5001/taxbaik/admin/login 2>/dev/null || echo "000")
              if [ "\$LOGIN_STATUS" != "200" ]; then
                echo "❌ 관리자 로그인 페이지 로드 실패 (상태: \$LOGIN_STATUS)" >&2
                exit 1
              fi
              echo "✓ [5/5] 관리자 페이지 로드 완료"

              echo "✓ 서비스 정상 (시도 \$i/\$ATTEMPTS)"
              # 구 배포 디렉토리 정리 (최근 5개 보존)
              ls -1dt \$DEPLOY_HOME/deployments/taxbaik_* 2>/dev/null \
                | tail -n +6 | xargs rm -rf 2>/dev/null || true
              exit 0
            fi
            if [ "\$i" -eq "\$ATTEMPTS" ]; then
              echo "=== FATAL: 서비스가 \$ATTEMPTS회 시도 후에도 응답하지 않음 ===" >&2
              echo "--- systemd 상태 ---" >&2
              systemctl is-active taxbaik >&2 || true
              echo "--- 최근 로그 50줄 ---" >&2
              journalctl -u taxbaik --no-pager -n 50 >&2
              exit 1
            fi
            echo "  대기 중... (\$i/\$ATTEMPTS, HTTP \$STATUS)"
            sleep 3
          done
          REMOTE

          echo "✓ 배포 완료: taxbaik_${TIMESTAMP} @ $DEPLOY_HOST"
          send_telegram "✅ <b>TaxBaik 배포 완료</b>

          커밋: <code>${COMMIT}</code>
          시간: <code>${TIMESTAMP}</code>
          대상: <code>${DEPLOY_HOST}</code>
          채널: <code>${TELEGRAM_CHAT_ID}</code>"