name: CI/CD Pipeline for mengning.com.cn
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
 
jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: gitea/runner-images:ubuntu-latest
    steps:
      - name: 拉取代码
        uses: https://devstar.cn/actions/checkout@v4
        with:
          fetch-depth: 0  
 
      - name: 安装依赖
        working-directory: 
        run: |
            npm install
            npm add -D vitepress
 
      - name: 构建项目
        working-directory: 
        run: |
            chmod +x node_modules/.bin/vitepress
            npm run build
 
      - name: 构建 Docker 镜像
        run: |
          docker build -t devstar-docs:${{ gitea.sha }} .
 
      - name: 登录 Docker Registry 并推送镜像
        run: |
          echo "${{ secrets.DOCKER_REGISTRY_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_REGISTRY_USERNAME }} ${{ vars.DOCKER_REGISTRY_ADDRESS }} --password-stdin
          docker tag devstar-docs:${{ gitea.sha }} ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:${{ gitea.sha }}
          docker tag devstar-docs:${{ gitea.sha }} ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:latest
          docker push ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:${{ gitea.sha }}
          docker push ${{ vars.DOCKER_REGISTRY_ADDRESS }}/${{ vars.DOCKER_REPOSITORY_ARTIFACT}}:latest    

      - name: 📝 Update mengning.com.cn（通过删除/创建 Application CRD）
        env:
          DOCKER_REGISTRY_ADDRESS: ${{ vars.DOCKER_REGISTRY_ADDRESS }}
          DOCKER_REPOSITORY_ARTIFACT: ${{ vars.DOCKER_REPOSITORY_ARTIFACT }}
          TLS_CERTIFICATE: ${{ secrets.TLS_CERTIFICATE }}
          TLS_PRIVATE_KEY: ${{ secrets.TLS_PRIVATE_KEY }}
        run: |
          curl -LO https://mirrors.ustc.edu.cn/kubernetes/core%3A/stable%3A/v1.28/deb/amd64/kubectl_1.28.0-1.1_amd64.deb
          sudo dpkg -i kubectl_1.28.0-1.1_amd64.deb
          kubectl config set-cluster remote-cluster --server=${{ secrets.K8S_URL }} --insecure-skip-tls-verify=true
          kubectl config set-credentials token-user --token=${{ secrets.K8S_TOKEN }}
          kubectl config set-context remote-context --cluster=remote-cluster --user=token-user
          kubectl config use-context remote-context

          # 创建或更新 TLS Secret（在 istio-system 命名空间）
          # Secret 名称: mengningsoftware-tls
          echo "$TLS_CERTIFICATE" > /tmp/tls.crt
          echo "$TLS_PRIVATE_KEY" > /tmp/tls.key
          kubectl create secret tls mengningsoftware-tls \
            --cert=/tmp/tls.crt \
            --key=/tmp/tls.key \
            -n istio-system \
            --dry-run=client -o yaml | kubectl apply -f -
          rm -f /tmp/tls.crt /tmp/tls.key

          # 替换 Application YAML 中的镜像地址变量并应用
          sed "s|\${DOCKER_REGISTRY_ADDRESS}|${DOCKER_REGISTRY_ADDRESS}|g; s|\${DOCKER_REPOSITORY_ARTIFACT}|${DOCKER_REPOSITORY_ARTIFACT}|g" \
            .gitea/workflows/application.yaml > /tmp/application-crd.yaml

          # 删除旧的 Application CRD（如果存在，忽略错误）
          kubectl delete application mengningsoftware -n web-servers --ignore-not-found=true || true

          # 创建新的 Application CRD
          kubectl apply -f /tmp/application-crd.yaml