name: Docker Build and Push

# 仅 main 分支 push 触发 (每次提交 → 自动部署)
# 每次主分支提交: 构建前端 + 生成 OTA 升级包 (minisign 签名) → 打进 Docker 镜像 → 部署到 :3002
# OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
# 容器挂载具名卷 wardrobe-ota:/app/ota-package, 部署时 docker cp 把镜像内置 OTA 灌进卷;
# 之后可运行 ota-only.yml 只更新 OTA 包 (热更前端), 无需重建镜像/APK/重启进程
# 依赖配置注册中心 (bh.vps.honor3.com:8008):
#   - service-wardrobe / ota : MINISIGN_PRIVATE_KEY (整段 .key 内容, 多行)
#   - service-wardrobe / ota : OTA_ADMIN_TOKEN (单行, OTA-only 上传接口鉴权)
on:
  push:
    branches:
      - main
      - master

jobs:
  build-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      # VITE_API_BASE 留空 = 前端走同源 /api (OTA server 同进程托管首页 + OTA 接口)
      VITE_API_BASE: ""
      CONFIG_CENTER_URL: '${{ secrets.CONFIG_CENTER_URL }}'
      CONFIG_CENTER_TOKEN: '${{ secrets.CONFIG_CENTER_TOKEN }}'
      REGISTRY_URL_FALLBACK: 'http://bh.vps.honor3.com:8008'
      CFG_PROJECT_SIGNING: 'proj-mtwjnvir-k52zvp'

    steps:
      - uses: https://gitea.com/actions/checkout@v4

      - name: Setup Node
        uses: https://gitea.com/actions/setup-node@v4
        with:
          node-version: 22

      - name: Install deps
        run: npm ci --no-audit --no-fund

      - name: Build frontend
        # dist/ 供 OTA 打包用 (Dockerfile 内也会构建一份)
        run: npm run build

      - name: Install minisign
        run: sudo apt-get update && sudo apt-get install -y minisign

      - name: Fetch config center (minisign key + ota admin token)
        # 私钥直接写文件 (build-ota.mjs 默认 KEY_PATH 即 ota-package/hotswap.key),
        # 绕开 GITHUB_ENV 多行值在 Gitea Actions 下不可靠的问题
        run: |
          set -euo pipefail
          export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
          python3 - <<'PYEOF'
          import json, os, urllib.request
          url = os.environ["CONFIG_CENTER_URL"]
          token = os.environ.get("CONFIG_CENTER_TOKEN", "") or ""
          req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_SIGNING']}/configs")
          if token:
              req.add_header("Authorization", "Bearer " + token)
          with urllib.request.urlopen(req, timeout=20) as r:
              data = json.load(r).get("data", [])
          key_val = next((c.get("value", "") for c in data if c.get("key") == "MINISIGN_PRIVATE_KEY"), None)
          ota_admin = next((c.get("value", "") for c in data if c.get("key") == "OTA_ADMIN_TOKEN"), None)
          if not key_val:
              raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
          if not ota_admin:
              raise SystemExit("配置中心缺少 OTA_ADMIN_TOKEN (service-wardrobe/ota, 单行)")
          os.makedirs("ota-package", exist_ok=True)
          with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
              f.write(key_val if key_val.endswith("\n") else key_val + "\n")
          os.chmod("ota-package/hotswap.key", 0o600)
          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
              f.write(f"OTA_ADMIN_TOKEN={ota_admin}\n")
          PYEOF
          echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)" 
          echo "OTA_ADMIN_TOKEN set: $([ -n "${OTA_ADMIN_TOKEN}" ] && echo yes || echo no)"

      - name: Build & sign OTA package
        # 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
        # 产物 ota-package/ (tar.gz + latest.json + .minisig) 进入 docker build context, 由 Dockerfile COPY 进镜像
        env:
          OTA_NOTES: ${{ github.sha }}
        run: |
          set -euo pipefail
          # --key 显式指定 (默认路径相同); 私钥已由上一步写入该文件
          node scripts/build-ota.mjs --out ota-package --key ota-package/hotswap.key --notes ${OTA_NOTES}
          echo "===== latest.json ====="
          cat ota-package/latest.json
          echo "===== bundle sha256 ====="
          sha256sum ota-package/wardrobe-ota.tar.gz

      - name: Build Docker image
        run: docker build -t wardrobe:latest .

      - name: List images
        run: docker images

      - name: Remove old container
        run: docker rm -vf wardrobe || true

      - name: Run container
        # 一键镜像: 前端 + OTA + 首页, 端口 3002 (与 iboard 的 3001 同机共存)
        # 业务数据放具名卷 wardrobe-data, 部署不丢数据
        # OTA 放具名卷 wardrobe-ota 并 docker cp 灌入本包内容:
        #   卷独立于镜像存在 → 之后 ota-only.yml 可直接覆盖, 设备立即热更, 无需重建镜像
        run: |
          set -euo pipefail
          docker run -d --name wardrobe -p 3002:3002 \
            -v wardrobe-data:/app/data \
            -v wardrobe-ota:/app/ota-package \
            -e OTA_ADMIN_TOKEN="${OTA_ADMIN_TOKEN}" \
            wardrobe:latest
          echo "===== 灌入内置 OTA 包 (容器仍在运行, 下次发布热更即可覆盖) ====="
          docker cp ota-package/. wardrobe:/app/ota-package/
          echo "===== 验证 ====="
          docker exec wardrobe ls -la /app/ota-package/
          docker exec wardrobe bash -c 'test -s /app/ota-package/latest.json && echo "latest.json OK"'