name: TDevOpsCICD

on: [push]

jobs:
  build-kit:
    runs-on: ubuntu-latest
    steps:
      - uses: https://gitea.com/actions/checkout@v4

      - name: 从配置中心加载密钥
        env:
          CONFIG_CENTER_URL: ${{ secrets.CONFIG_CENTER_URL }}
          CONFIG_CENTER_TOKEN: ${{ secrets.CONFIG_CENTER_TOKEN }}
        run: |
          set -e
          BASE_URL="${CONFIG_CENTER_URL:-http://bh.vps.honor3.com:8008}"
          AUTH_ARGS=()
          if [ -n "$CONFIG_CENTER_TOKEN" ]; then
            AUTH_ARGS=(-H "Authorization: Bearer ${CONFIG_CENTER_TOKEN}")
          fi
          curl -fsSL "${AUTH_ARGS[@]}" "$BASE_URL/api/projects" -o /tmp/cc-projects.json
          node -e '
            const fs = require("fs");
            const projects = JSON.parse(fs.readFileSync("/tmp/cc-projects.json", "utf8")).data;
            const proj = projects.find(p => p.name === "CommonExternalService");
            if (!proj) { console.error("project CommonExternalService not found"); process.exit(1); }
            fs.writeFileSync("/tmp/cc-project-id", proj.id);
          '
          PROJECT_ID=$(cat /tmp/cc-project-id)
          curl -fsSL "${AUTH_ARGS[@]}" "$BASE_URL/api/projects/$PROJECT_ID/configs" -o /tmp/cc-configs.json
          node -e '
            const fs = require("fs");
            const data = JSON.parse(fs.readFileSync("/tmp/cc-configs.json", "utf8")).data;
            const allow = ["CF_API_TOKEN","CF_R2_PUBLIC_URL","CF_R2_BUCKET","GH_TOKEN","GH_OWNER","GH_REPO","GH_BRANCH"];
            const loaded = [];
            for (const c of data) {
              const key = String(c.key).split("/").pop();
              if (allow.includes(key) && c.value) {
                fs.appendFileSync(process.env.GITHUB_ENV, `${key}=${c.value}\n`);
                loaded.push(key);
              }
            }
            console.log("loaded config keys:", loaded.join(", "));
          '

      - name: Setup Bun
        run: |
          curl -fsSL https://bun.sh/install | bash
          export BUN_INSTALL="$HOME/.bun"
          export PATH="$BUN_INSTALL/bin:$PATH"
          echo "BUN_INSTALL=$HOME/.bun" >> $GITHUB_ENV
          echo "$HOME/.bun/bin" >> $GITHUB_PATH

      - name: Install pkg
        run: npm i -g pkg

      - name: Install deps
        run: |
          cd kit
          bun i

      - name: Build Windows (bun 交叉编译)
        run: |
          cd kit
          bun run windows
          ls -la ./dist/windows/

      - name: Build Linux (bun, 现代 glibc)
        run: |
          cd kit
          bun run linux
          ls -la ./dist/linux/

      - name: Build Linux (pkg, 低版本 glibc / Kylin V10) + 打包 zip
        run: |
          set -e
          cd kit
          # pkg 首次构建需要从 GitHub 下载 node14 基础运行时，网络不稳时重试
          for i in 1 2 3; do npm run pkg-linux && break || sleep 5; done
          test -f ./dist/kylin/kit || { echo "pkg build failed"; exit 1; }
          if ! command -v zip >/dev/null 2>&1; then
            (apt-get update -qq && apt-get install -y -qq zip) >/dev/null 2>&1 || true
          fi
          command -v zip >/dev/null 2>&1 || { echo "zip not available"; exit 1; }
          cd ./dist/kylin
          zip -9 -j kit.zip kit
          rm -f kit
          ls -la .

      - name: 上传二进制到 Cloudflare R2（公开桶）
        run: |
          set -e
          test -n "$CF_API_TOKEN" || { echo "CF_API_TOKEN 未从配置中心加载"; exit 1; }
          npm i -g wrangler
          export CLOUDFLARE_API_TOKEN="$CF_API_TOKEN"
          # 仅需 token，wrangler 会自动从 token 解析账号 ID，无需 CF_ACCOUNT_ID
          BUCKET="${CF_R2_BUCKET:-store}"
          wrangler r2 object put "$BUCKET/data/windows/kit.exe" --file ./kit/dist/windows/kit.exe --content-type application/octet-stream --remote
          wrangler r2 object put "$BUCKET/data/linux/kit" --file ./kit/dist/linux/kit --content-type application/octet-stream --remote
          wrangler r2 object put "$BUCKET/data/kylin/kit.zip" --file ./kit/dist/kylin/kit.zip --content-type application/zip --remote

      - name: 发布 website 到 GitHub（触发 Cloudflare Pages 自动部署）
        env:
          REF_NAME: ${{ github.ref_name }}
          SHA: ${{ github.sha }}
        run: |
          set -e
          test -n "$GH_TOKEN" || { echo "GH_TOKEN 未从配置中心加载"; exit 1; }
          mkdir -p website/static/data
          cat > website/static/data/kit.json <<EOF
          {
            "version": "${REF_NAME}",
            "commit": "${SHA}",
            "updatedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
            "binaries": {
              "windows": { "url": "${CF_R2_PUBLIC_URL}/data/windows/kit.exe" },
              "linux":   { "url": "${CF_R2_PUBLIC_URL}/data/linux/kit" },
              "kylin":   { "url": "${CF_R2_PUBLIC_URL}/data/kylin/kit.zip" }
            }
          }
          EOF
          cat website/static/data/kit.json
          URL="https://x-access-token:${GH_TOKEN}@github.com/${GH_OWNER}/${GH_REPO}.git"
          BRANCH="${GH_BRANCH:-main}"
          rm -rf /tmp/website-pub
          if git clone --depth 1 --branch "$BRANCH" "${URL}" /tmp/website-pub 2>/dev/null; then
            cp -a website/. /tmp/website-pub/
          else
            rm -rf /tmp/website-pub
            mkdir -p /tmp/website-pub
            cd /tmp/website-pub
            git init -b "$BRANCH"
            git remote add origin "${URL}"
            cp -a "$GITHUB_WORKSPACE/website/." .
          fi
          cd /tmp/website-pub
          git config user.name "kit-ci"
          git config user.email "kit-ci@honor3.com"
          git add -A
          if git diff --cached --quiet; then
            echo "No website changes to publish"
          else
            git commit -m "release(website): publish kit ${REF_NAME}"
            git push origin "$BRANCH"
          fi