when:
  - event: push
    branch: main
    path:
      exclude: ['**']
      ignore_message: '[infra]'


steps:
  - name: version
    image: alpine:latest
    commands:
      - set -euo pipefail
      - apk add --no-cache git
      - GIT_REV="$(git rev-parse --short HEAD)"
      - BUILD_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
      - APP_V="$(cat version)"
      - printf "GIT_REV=%s\nBUILD_BRANCH=%s\nAPP_V=%s\n" "$GIT_REV" "$BUILD_BRANCH" "$APP_V" | tee .env.version

  - name: secrets
    image: alpine:latest
    depends_on: [ version ]
    environment:
      VAULT_ADDR: { from_secret: VAULT_ADDR }
      VAULT_ROLE_ID:   { from_secret: VAULT_APP_ROLE }
      VAULT_SECRET_ID: { from_secret: VAULT_SECRET_ID }
    commands:
      - set -euo pipefail
      - apk add --no-cache bash coreutils openssh-keygen curl sed python3
      - sh ci/scripts/common/fetch_deploy_ssh_key.sh secrets/SSH_KEY

  - name: deploy
    image: alpine:latest
    depends_on: [ secrets ]
    environment:
      VAULT_ADDR: { from_secret: VAULT_ADDR }
      VAULT_ROLE_ID:   { from_secret: VAULT_APP_ROLE }
      VAULT_SECRET_ID: { from_secret: VAULT_SECRET_ID }
    commands:
      - set -euo pipefail
      - apk add --no-cache bash openssh-client rsync coreutils curl sed python3
      - mkdir -p /root/.ssh
      - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
      - . ./ci/scripts/common/runtime_env.sh
      - load_runtime_env_bundle "$(resolve_runtime_env_name)"
      - export NATS_USER="$(sh ci/scripts/common/runtime_kv_get.sh kv_get kv sendico/nats user 2>/dev/null || CI_VAULT_SOURCE=external ./ci/vlt kv_get kv sendico/nats user)"
      - export NATS_PASSWORD="$(sh ci/scripts/common/runtime_kv_get.sh kv_get kv sendico/nats password 2>/dev/null || CI_VAULT_SOURCE=external ./ci/vlt kv_get kv sendico/nats password)"
      - bash ci/prod/scripts/bootstrap/network.sh
      - bash ci/prod/scripts/deploy/nats.sh