# name: Deploy to K3s

# on:
#   push:
#     branches:
#       - main # Or your default branch

# env:
#   # Set your image name, adjust if your GitHub username/org is different from the repo owner
#   # Or if your repo name is not what you want for the image name.
#   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
#   K8S_NAMESPACE: aprs-app

# jobs:
#   build-and-push-image:
#     runs-on: ubuntu-latest
#     permissions:
#       contents: read
#       packages: write # Needed to push to GHCR

#     steps:
#       - name: Tailscale
#         uses: tailscale/github-action@v3
#         with:
#           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
#           oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
#           tags: tag:ci
#           use-cache: "true"

#       - name: Checkout code
#         uses: actions/checkout@v4

#       - name: Set up QEMU
#         uses: docker/setup-qemu-action@v3

#       - name: Set up Docker Buildx
#         id: buildx
#         uses: docker/setup-buildx-action@v3

#       - name: Login to GitHub Container Registry
#         uses: docker/login-action@v3
#         with:
#           registry: ghcr.io
#           username: ${{ github.actor }}
#           password: ${{ secrets.GITHUB_TOKEN }}

#       - name: Extract metadata (tags, labels) for Docker
#         id: meta
#         uses: docker/metadata-action@v5
#         with:
#           images: ${{ env.IMAGE_NAME }}
#           tags: |
#             type=sha,prefix=
#             type=raw,value=latest,enable={{is_default_branch}}

#       - name: Build and push Docker image
#         uses: docker/build-push-action@v5
#         with:
#           context: .
#           push: true
#           tags: ${{ steps.meta.outputs.tags }}
#           labels: ${{ steps.meta.outputs.labels }}
#           cache-from: type=gha
#           cache-to: type=gha,mode=max

#   deploy-to-k3s:
#     runs-on: ubuntu-latest
#     needs: build-and-push-image
#     if: github.ref == 'refs/heads/main' # Only deploy from main branch

#     steps:
#       - name: Checkout code
#         uses: actions/checkout@v4

#       - name: Tailscale
#         uses: tailscale/github-action@v3
#         with:
#           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
#           oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
#           tags: tag:ci
#           use-cache: "true"

#       - name: Set up Kubeconfig
#         uses: azure/setup-kubectl@v3 # A popular action for kubectl
#         # Alternatively, can do this manually:
#         # run: |
#         #   mkdir -p $HOME/.kube
#         #   echo "${{ secrets.KUBE_CONFIG_DATA }}" | base64 -d > $HOME/.kube/config
#         #   chmod 600 $HOME/.kube/config

#       - name: Install Kustomize (optional, but good for managing overlays)
#         run: |-
#           curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
#           sudo mv kustomize /usr/local/bin/
#         # If not using kustomize, this step can be removed.
#         # For now, we'll use kubectl apply -f directly for simplicity.

#       - name: Substitute Image Tag in Kubernetes Manifest
#         run: |
#           # The meta step outputs tags like: ghcr.io/owner/repo:sha-xxxxxxx,ghcr.io/owner/repo:latest
#           # We need to pick the SHA-based tag.
#           # github.sha gives the commit SHA, which is perfect for a specific tag.
#           ACTUAL_IMAGE_NAME_WITH_TAG="${{ env.IMAGE_NAME }}:${{ github.sha }}"
#           echo "Using image: $ACTUAL_IMAGE_NAME_WITH_TAG"

#           # Create a temporary deployment file for substitution
#           cp k8s/app-deployment.yaml k8s/app-deployment-processed.yaml

#           # Replace placeholder image in the processed file
#           # Using a different delimiter for sed due to slashes in image name
#           sed -i "s|your-ghcr-username/aprs-app:latest|$ACTUAL_IMAGE_NAME_WITH_TAG|g" k8s/app-deployment-processed.yaml
#           # Ensure initContainer is also updated (duplicate sed command is fine, ensures both are hit if structure changes)
#           sed -i "s|your-ghcr-username/aprs-app:latest|$ACTUAL_IMAGE_NAME_WITH_TAG|g" k8s/app-deployment-processed.yaml

#       - name: Apply Kubernetes manifests
#         env:
#           KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }} # Pass secret to env for kubectl if not using azure/setup-kubectl
#         run: |
#           # Ensure Kubeconfig is set up if not using an action
#           if [ ! -f "$HOME/.kube/config" ] && [ -n "$KUBE_CONFIG_DATA" ]; then
#             mkdir -p $HOME/.kube
#             echo "$KUBE_CONFIG_DATA" | base64 -d > $HOME/.kube/config
#             chmod 600 $HOME/.kube/config
#             echo "Kubeconfig set up manually."
#           elif [ ! -f "$HOME/.kube/config" ] && [ -z "$KUBE_CONFIG_DATA" ] && [ -z "$(kubectl config current-context 2>/dev/null)" ]; then
#             echo "Kubeconfig not found. KUBE_CONFIG_DATA secret is not set or empty, and no context is set by azure/setup-kubectl."
#             exit 1
#           fi

#           # Apply namespace first
#           kubectl apply -f k8s/namespace.yaml --insecure-skip-tls-verify

#           # Apply secrets if a real one exists (checking for secrets.yaml, not secrets.yaml.example)
#           # This assumes you will create the actual secrets.yaml in a secure way or it's handled by another process.
#           # For this automated workflow, we'll only apply if the example isn't the only one.
#           # A better way is to manage actual secrets outside the repo & this flow.
#           # For now, we expect secrets to be pre-applied or managed via a more secure mechanism.
#           # So, we will NOT apply secrets.yaml.example here. The user must ensure secrets are present.
#           echo "Ensuring secrets are present in namespace ${{ env.K8S_NAMESPACE }}. This workflow does not apply them directly from a .example file."

#           # Apply other resources
#           kubectl apply -f k8s/postgres-pvc.yaml --namespace=${{ env.K8S_NAMESPACE }} --insecure-skip-tls-verify
#           # It's good practice to check if a resource exists before applying or use --overwrite, but apply usually handles this.
#           # For sensitive or stateful things like Postgres, ensure your strategy for updates is clear.
#           kubectl apply -f k8s/postgres-deployment.yaml --namespace=${{ env.K8S_NAMESPACE }} --insecure-skip-tls-verify
#           kubectl apply -f k8s/postgres-service.yaml --namespace=${{ env.K8S_NAMESPACE }} --insecure-skip-tls-verify

#           # Apply the processed app deployment
#           kubectl apply -f k8s/app-deployment-processed.yaml --namespace=${{ env.K8S_NAMESPACE }} --insecure-skip-tls-verify
#           kubectl apply -f k8s/app-service.yaml --namespace=${{ env.K8S_NAMESPACE }} --insecure-skip-tls-verify

#           echo "Deployment to K3s initiated."

#           # Optional: Wait for rollout to complete
#           # kubectl rollout status deployment/aprs-app-deployment --namespace=${{ env.K8S_NAMESPACE }} --timeout=120s --insecure-skip-tls-verify