name: Provision Coder Templates

# Keeps Coder templates in sync with templates/*/ in this repo:
#   - every push to main pushes a new version of each templates/<env>/ dir
#     (coder templates push creates it if it doesn't exist yet, so adding a
#     new templates/<env>/ directory is enough to provision a new one)
#   - if a templates/<env>/ directory is removed on main, its template is
#     deleted from Coder. `coder templates delete` refuses to delete a
#     template that still has active workspaces, so this can't silently
#     orphan running workspaces - it just fails loudly and needs a human.
#
# Requires two repo/org secrets (Settings > Actions > Secrets):
#   CODER_URL             e.g. https://code.octoturge.com
#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
#                          dedicated service account rather than a personal one
#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
#                          with write:package scope, for pushing templates/web's
#                          image to this instance's container registry. Only
#                          the octoturge account's own token is used - login()
#                          hardcodes that username to match.
#
# templates/web builds its Docker image here (build-web-image, on the
# dedicated "docker-build" runner - see templates/web/main.tf for why: that
# runner is scoped to this repo only and has host Docker socket access that
# the shared runner-1 deliberately doesn't). provision then just pulls the
# tag build-web-image produced, instead of building it itself at
# `terraform apply` time - keeps the slow Rust toolchain compile off of
# "someone is waiting to create a workspace".

on:
  push:
    branches: [main]
    paths:
      - "templates/**"
      - ".gitea/workflows/coder-templates.yml"
  workflow_dispatch: {}

jobs:
  build-web-image:
    # The docker-build runner's docker_host: "" setting already auto-injects
    # /var/run/docker.sock into job containers - an explicit
    # container.volumes mount for the same path here fails at container
    # creation with "Duplicate mount point: /var/run/docker.sock".
    runs-on: docker-build
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build and push templates/web's image (skips if the tag already exists)
        run: |
          set -e
          TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
          IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
          if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
            echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
            exit 0
          fi
          docker build -t "$IMAGE" templates/web
          docker push "$IMAGE"

  provision:
    needs: build-web-image
    runs-on: ubuntu-latest
    env:
      CODER_URL: ${{ secrets.CODER_URL }}
      CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
    steps:
      - name: Checkout (full history, needed to detect removed templates)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install coder CLI
        run: |
          set -e
          curl -fsSL https://coder.com/install.sh | sh
          coder version

      - name: Push (create or update) every template
        run: |
          set -e
          for dir in templates/*/; do
            name="profiles-$(basename "$dir")"
            echo "::group::Pushing $name from $dir"
            coder templates push "$name" -d "$dir" --yes \
              -m "auto-provisioned from ${GITHUB_SHA:0:12}"
            echo "::endgroup::"
          done

      - name: Delete templates whose directory was removed
        if: github.event_name == 'push'
        run: |
          set -e
          PREV_SHA="$(git rev-parse HEAD~1 2>/dev/null || true)"
          if [ -z "$PREV_SHA" ]; then
            echo "No previous commit on this branch (first push), nothing to diff. Skipping."
            exit 0
          fi

          OLD_DIRS="$(git ls-tree -d --name-only "$PREV_SHA" -- 'templates/*' 2>/dev/null | xargs -n1 basename 2>/dev/null || true)"
          if [ -z "$OLD_DIRS" ]; then
            echo "No templates/ directory at $PREV_SHA, nothing to diff. Skipping."
            exit 0
          fi

          for old in $OLD_DIRS; do
            if [ ! -d "templates/$old" ]; then
              name="profiles-$old"
              echo "::group::Deleting $name (templates/$old was removed)"
              coder templates delete "$name" --yes \
                || echo "::warning::Failed to delete $name - check for active workspaces still using it."
              echo "::endgroup::"
            fi
          done