name: iam-ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      VIOLIN_IAM_SERVICE_TOKEN_SECRET: "0011223344556677889900aabbccddeeff0011223344556677889900aabbccddeeff"
      VIOLIN_JWT_PRIVATE_KEY_PATH: ""
      SPRING_PROFILES_ACTIVE: dev

    steps:
      # Step 1: compile + run tests. Replaces Drone's `compile` step but does
      # NOT skip tests — this is a CI gate on every PR.
      - name: Compile + test violin-iam
        image: gitea.violin-work.online/registry/maven:3.9-eclipse-temurin-22
        env:
          MAVEN_OPTS: "-Dmaven.repo.local=/root/.m2/repository"
        commands:
          - mkdir -p /root/.m2/repository
          - for m in violin-parent violin-common violin-core; do
              echo "--- installing $m ---";
              mvn -B -f "$m/pom.xml" clean install -DskipTests;
            done
          - mvn -B -f violin-iam/pom.xml verify

      # Step 2: build image via kaniko and push to the violin registry.
      # Mirrors the `drone-kaniko` plugin used by .drone.yml. Only runs on
      # pushes to main (PR branches just want the test gate).
      - name: Build and push image
        if: gitea.ref == 'refs/heads/main'
        image: gitea.violin-work.online/registry/drone-kaniko:latest
        settings:
          repo: gitea.violin-work.online/violin/violin-iam
          tags:
            - latest
            - ${GITEA_SHA:0:8}
          dockerfile: Dockerfile
          context: .
          registry: gitea.violin-work.online
          username: simple321vip
          password:
            from_secret: docker_password

      # Step 3: roll the deployment. Only after main-branch image push.
      - name: Deploy to violin namespace
        if: gitea.ref == 'refs/heads/main'
        image: gitea.violin-work.online/registry/kubectl:latest
        commands:
          - kubectl set image deployment/violin-iam violin-iam=gitea.violin-work.online/violin/violin-iam:${GITEA_SHA:0:8} -n violin