name: Build and Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    container:
      image: quay.io/buildah/stable
    steps:
      - name: Checkout
        env:
          # Values reach the shell as environment variables rather than being
          # interpolated into the command, so a crafted branch name cannot run
          # as part of it.
          REF_NAME: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
          TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          # The clone URL is spelled out: github.server_url resolves to Gitea's
          # in-cluster address, which the runner can reach but has no
          # credentials for. The token authenticates a private repo.
          git clone --depth 1 --branch "$REF_NAME" \
            "https://x-access-token:${TOKEN}@git.scottyah.com/${REPO}.git" .
          git checkout "$GITHUB_SHA"

      - name: Build image
        run: |
          IMAGE=harbor.scottyah.com/scottyah/tracker
          buildah --isolation chroot bud -t $IMAGE:${{ github.sha }} -t $IMAGE:latest .

      - name: Push image
        run: |
          IMAGE=harbor.scottyah.com/scottyah/tracker
          # Harbor serves a publicly trusted certificate, so TLS is verified.
          # Disabling verification would send these credentials, and accept the
          # image, over a connection nothing has authenticated.
          buildah login -u "$HARBOR_USERNAME" -p "$HARBOR_PASSWORD" harbor.scottyah.com
          buildah push $IMAGE:${{ github.sha }}
          buildah push $IMAGE:latest
        env:
          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}

      - name: Deploy
        run: |
          curl -LO "https://dl.k8s.io/release/$(curl -Ls https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x kubectl
          mkdir -p ~/.kube
          echo "${{ secrets.KUBECONFIG_DATA }}" | base64 -d > ~/.kube/config
          sed -i "s|harbor.scottyah.com/scottyah/tracker:latest|harbor.scottyah.com/scottyah/tracker:${{ github.sha }}|" k8s.yaml
          ./kubectl apply -f k8s.yaml
          ./kubectl rollout status deployment/tracker-dep -n tracker --timeout=120s