#!/bin/sh
set -e

COMMAND="${INPUT_COMMAND:-deploy}"
CONFIG="${INPUT_CONFIG:-kforge.yml}"

# Build a kubeconfig from the standard KUBE_* CI secrets.
setup_kube() {
  [ -z "$KUBE_HOST" ] && return
  mkdir -p ~/.kube
  cat > ~/.kube/config <<KUBEEOF
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: ${KUBE_CERTIFICATE}
    server: ${KUBE_HOST}
  name: kforge
contexts:
- context:
    cluster: kforge
    user: kforge
  name: kforge
current-context: kforge
users:
- name: kforge
  user:
    token: ${KUBE_TOKEN}
KUBEEOF
  chmod 600 ~/.kube/config
}

cd "${GITHUB_WORKSPACE:-/github/workspace}"

case "$COMMAND" in
  deploy)
    export KFORGE_IMAGE_TAG="$(git rev-parse --short HEAD)"
    setup_kube
    kforge validate -c "$CONFIG"
    if [ -n "$INPUT_ENV" ]; then
      kforge secrets apply --env "$INPUT_ENV" -c "$CONFIG"
      kforge generate --env "$INPUT_ENV" --output .kforge-out -c "$CONFIG"
    else
      kforge generate --output .kforge-out -c "$CONFIG"
    fi
    kubectl apply -f .kforge-out/ --insecure-skip-tls-verify
    NAMESPACE="${INPUT_NAMESPACE:-${INPUT_ENV}}"
    if [ -n "$NAMESPACE" ]; then
      kubectl rollout restart deployment -n "$NAMESPACE" --insecure-skip-tls-verify || true
    fi
    ;;

  preview-up)
    [ -z "$INPUT_PR_NUMBER" ] && echo "::error::pr_number input is required for preview-up" && exit 1
    setup_kube
    kforge secrets apply --pr-number "$INPUT_PR_NUMBER" -c "$CONFIG"
    kforge generate --pr-number "$INPUT_PR_NUMBER" --output .kforge-out -c "$CONFIG"
    kubectl apply -f .kforge-out/ --insecure-skip-tls-verify
    NS="${INPUT_NAMESPACE_PREFIX:-preview-pr}-${INPUT_PR_NUMBER}"
    kubectl rollout status deployment -n "$NS" --timeout=120s --insecure-skip-tls-verify || true
    ;;

  preview-down)
    [ -z "$INPUT_PR_NUMBER" ] && echo "::error::pr_number input is required for preview-down" && exit 1
    setup_kube
    NS="${INPUT_NAMESPACE_PREFIX:-preview-pr}-${INPUT_PR_NUMBER}"
    kubectl delete namespace "$NS" --ignore-not-found --insecure-skip-tls-verify
    ;;

  validate)
    kforge validate -c "$CONFIG"
    ;;

  secrets)
    setup_kube
    if [ -n "$INPUT_PR_NUMBER" ]; then
      kforge secrets apply --pr-number "$INPUT_PR_NUMBER" -c "$CONFIG"
    elif [ -n "$INPUT_ENV" ]; then
      kforge secrets apply --env "$INPUT_ENV" -c "$CONFIG"
    else
      echo "::error::env or pr_number input is required for the secrets command"
      exit 1
    fi
    ;;

  *)
    echo "::error::Unknown command '$COMMAND'. Valid: deploy, preview-up, preview-down, validate, secrets"
    exit 1
    ;;
esac