name: lingonpaj-site

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
      GITEA_REPOSITORY: ${{ gitea.repository }}
    steps:
      - uses: actions/checkout@v7
      - uses: buildtool/setup-buildtools-action@v1
      - name: Build and push
        run: unset GITEA_TOKEN && build && push

  deploy-prod-frostmoln:
    needs: build
    if: gitea.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    env:
      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
      GITEA_REPOSITORY: ${{ gitea.repository }}
      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
    environment: prod
    steps:
      - uses: actions/checkout@v7
      - uses: buildtool/setup-buildtools-action@v1
      - name: Install fm
        run: |
          sudo install -d -m 0755 /etc/apt/keyrings
          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
          sudo apt-get update && sudo apt-get install -y fm
      - name: Deploy to Frostmoln production
        env:
          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
        # The cluster API is private: the kubeconfig's exec plugin opens an fm
        # tunnel on demand. fm reads the key from its config file, not the env.
        run: |
          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n sites