when:
  - event: push
    branch: sv-fe
    paths:
      - bobbin/**
      - crates/**
      - lexicons/**
      - Cargo.toml
      - Cargo.lock
      - rust-toolchain.toml
      - web/**
      - flake.nix
      - flake.lock
      - nix/pkgs/web-static-files.nix
      - .tangled/workflows/deploy-gcp-dev.yml

engine: microvm
image: nixos

virtualisation:
  docker: true

dependencies:
  - google-cloud-sdk
  - docker-buildx

environment:
  GCP_PROJECT: exemplary-proxy-507408-d6
  GCP_REGION: europe-north1
  REGISTRY: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled
  CI_SERVICE_ACCOUNT: ci-deployer-next@exemplary-proxy-507408-d6.iam.gserviceaccount.com
  IM_SERVICE_ACCOUNT: im-deployer-next@exemplary-proxy-507408-d6.iam.gserviceaccount.com
  DEPLOYMENT: tangled-dev
  BOBBIN_CACHE: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled/bobbin-cache:buildcache
  SVFE_CACHE: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled/svfe-cache:buildcache
  TF_VERSION: "=1.5.7"
  VITE_OAUTH_CLIENT_ID: https://svfe-next-264757501569.europe-north1.run.app/oauth-client-metadata.json
  VITE_OAUTH_REDIRECT_URI: https://svfe-next-264757501569.europe-north1.run.app/oauth/callback

steps:
  - name: authenticate to gcp
    command: |
      set -eu
      mkdir -p ~/.config/gcloud
      printf '%s' "$GCP_CI_CREDENTIALS" > ~/.config/gcloud/application_default_credentials.json
      gcloud auth application-default set-quota-project "$GCP_PROJECT" --quiet
      gcloud config set project "$GCP_PROJECT" --quiet
      gcloud auth application-default print-access-token \
        --impersonate-service-account="$CI_SERVICE_ACCOUNT" > "$HOME/.gcp-token"
      chmod 600 "$HOME/.gcp-token"
      docker login --username=oauth2accesstoken \
        --password="$(cat "$HOME/.gcp-token")" "$GCP_REGION-docker.pkg.dev"

  # bobbin's Containerfile copies from the repo root, so the root is the context
  - name: build and push bobbin
    command: |
      set -eu
      tag="dev-${TANGLED_COMMIT_SHA:0:8}"
      docker-buildx build \
        --file=bobbin/containerfiles/bobbin.Containerfile \
        --tag="$REGISTRY/bobbin-next:$tag" \
        --tag="$REGISTRY/bobbin-next:dev" \
        --provenance=false \
        --cache-from "type=registry,ref=$BOBBIN_CACHE" \
        --cache-to "type=registry,ref=$BOBBIN_CACHE,mode=max" \
        --push .
      echo "bobbin-next:$tag"

  - name: build and push svfe
    command: |
      set -eu
      tag="dev-${TANGLED_COMMIT_SHA:0:8}"

      out=$(nix build .#web-static-files --no-link --print-out-paths)
      mkdir -p web/static
      rm -rf web/static/fonts web/static/logos
      cp -fr "$out"/* web/static

      docker-buildx build \
        --file=web/Containerfile \
        --build-arg VITE_OAUTH_CLIENT_ID="$VITE_OAUTH_CLIENT_ID" \
        --build-arg VITE_OAUTH_REDIRECT_URI="$VITE_OAUTH_REDIRECT_URI" \
        --tag="$REGISTRY/svfe-next:$tag" \
        --tag="$REGISTRY/svfe-next:dev" \
        --provenance=false \
        --cache-from "type=registry,ref=$SVFE_CACHE" \
        --cache-to "type=registry,ref=$SVFE_CACHE,mode=max" \
        --push web/
      echo "svfe-next:$tag"

  # reuse the last deployed blueprint here.
  # we are only changing the container image
  - name: deploy
    command: |
      set -eu
      export CLOUDSDK_AUTH_ACCESS_TOKEN="$(cat "$HOME/.gcp-token")"
      dep="projects/$GCP_PROJECT/locations/$GCP_REGION/deployments/$DEPLOYMENT"

      src=$(gcloud infra-manager deployments describe "$dep" \
        --format='value(terraformBlueprint.gcsSource)')

      gcloud infra-manager deployments apply "$dep" \
        --service-account="projects/$GCP_PROJECT/serviceAccounts/$IM_SERVICE_ACCOUNT" \
        --gcs-source="$src" \
        --tf-version-constraint="$TF_VERSION"

      gcloud infra-manager deployments describe "$dep" --format='value(latestRevision)'