stages:
  - test
  - build
  - deploy

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  APP_IMAGE_REPOSITORY: "$CI_REGISTRY_IMAGE/app"
  ASTERISK_IMAGE_REPOSITORY: "$CI_REGISTRY_IMAGE/asterisk"
  APP_IMAGE_TAG: "$CI_COMMIT_SHA"
  ASTERISK_IMAGE_TAG: "$CI_COMMIT_SHA"
  APP_IMAGE: "$CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA"
  ASTERISK_IMAGE: "$CI_REGISTRY_IMAGE/asterisk:$CI_COMMIT_SHA"
  DOCKER_TLS_CERTDIR: "/certs"
  DOCKER_HOST: "tcp://docker:2376"
  DOCKER_TLS_VERIFY: "1"
  DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"

default:
  cache:
    paths:
      - .cache/pip

.python_job:
  image: python:3.11-slim
  before_script:
    - python -m pip install --upgrade pip
    - pip install -r requirements.txt

test:
  extends: .python_job
  stage: test
  script:
    - pytest -q

postgres-readiness:
  extends: .python_job
  stage: test
  services:
    - name: postgres:16-alpine
      alias: postgres
    - name: rabbitmq:3-management
      alias: rabbitmq
  variables:
    POSTGRES_DB: mvpcc
    POSTGRES_USER: mvp
    POSTGRES_PASSWORD: mvp
    DATABASE_URL: postgresql://mvp:mvp@postgres:5432/mvpcc
    SCHEMA_MANAGEMENT_MODE: migrations
    CC_DATA_DIR: .testdata_pg
    EVENT_BUS_ENABLED: "0"
    EVENT_BUS_URL: amqp://guest:guest@rabbitmq:5672/
    APP_TOKEN_SECRET: ci-secret
    ALLOW_LEGACY_HEADER_AUTH: "1"
    TELEGRAM_BOT_ENABLED: "0"
    WHATSAPP_OUTBOUND_ENABLED: "0"
    AI_PROVIDER: stub
    AI_TELEGRAM_ENABLED: "0"
    AI_WHATSAPP_ENABLED: "0"
    AI_VOICE_ENABLED: "0"
  script:
    - python scripts/migrate_core_db.py
    - pytest -q tests/test_postgres_readiness.py

.docker_build:
  image: docker:27
  services:
    - name: docker:27-dind
      alias: docker
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_TAG'

build-app-image:
  extends: .docker_build
  stage: build
  needs:
    - test
    - postgres-readiness
  script:
    - docker build -t "$APP_IMAGE" .
    - docker push "$APP_IMAGE"
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag "$APP_IMAGE" "$APP_IMAGE_REPOSITORY:latest"
        docker push "$APP_IMAGE_REPOSITORY:latest"
      fi
    - |
      if [ -n "$CI_COMMIT_TAG" ]; then
        docker tag "$APP_IMAGE" "$APP_IMAGE_REPOSITORY:$CI_COMMIT_TAG"
        docker push "$APP_IMAGE_REPOSITORY:$CI_COMMIT_TAG"
      fi

build-asterisk-image:
  extends: .docker_build
  stage: build
  needs:
    - test
    - postgres-readiness
  script:
    - docker build -f deployment/asterisk/Dockerfile -t "$ASTERISK_IMAGE" .
    - docker push "$ASTERISK_IMAGE"
    - |
      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
        docker tag "$ASTERISK_IMAGE" "$ASTERISK_IMAGE_REPOSITORY:latest"
        docker push "$ASTERISK_IMAGE_REPOSITORY:latest"
      fi
    - |
      if [ -n "$CI_COMMIT_TAG" ]; then
        docker tag "$ASTERISK_IMAGE" "$ASTERISK_IMAGE_REPOSITORY:$CI_COMMIT_TAG"
        docker push "$ASTERISK_IMAGE_REPOSITORY:$CI_COMMIT_TAG"
      fi

deploy-production:
  stage: deploy
  image: alpine:3.21
  needs:
    - build-app-image
    - build-asterisk-image
  environment:
    name: production
  before_script:
    - apk add --no-cache openssh-client rsync
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - printf '%s\n' "$DEPLOY_SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
    - chmod 600 ~/.ssh/id_ed25519
    - ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
  script:
    - test -n "$DEPLOY_HOST"
    - test -n "$DEPLOY_USER"
    - test -n "$DEPLOY_PATH"
    - ssh "$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p '$DEPLOY_PATH/deployment'"
    - rsync -av deployment/ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/deployment/"
    - |
      ssh "$DEPLOY_USER@$DEPLOY_HOST" \
        "mkdir -p '$DEPLOY_PATH/.data_local/generated_ivr_yandex/ivr' '$DEPLOY_PATH/.data_local/recordings' '$DEPLOY_PATH/.asterisk_assets'"
    - |
      ssh "$DEPLOY_USER@$DEPLOY_HOST" \
        "printf 'APP_IMAGE=%s\nASTERISK_IMAGE=%s\n' '$APP_IMAGE' '$ASTERISK_IMAGE' > '$DEPLOY_PATH/deployment/.env.images'"
    - |
      ssh "$DEPLOY_USER@$DEPLOY_HOST" \
        "echo '$CI_REGISTRY_PASSWORD' | docker login '$CI_REGISTRY' -u '$CI_REGISTRY_USER' --password-stdin && \
        cd '$DEPLOY_PATH/deployment' && \
        docker compose --env-file .env.images -f docker-compose.server.registry.yml pull && \
        docker compose --env-file .env.images -f docker-compose.server.registry.yml up -d && \
        docker compose --env-file .env.images -f docker-compose.asterisk.server.registry.yml pull && \
        docker compose --env-file .env.images -f docker-compose.asterisk.server.registry.yml up -d"
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: manual
  allow_failure: false