name: CI/CD - ERP Core Monorepo

on:
  pull_request:
    branches:
      - production
    types:
      - closed

jobs:
  build-and-deploy-backend:
    name: Build & Deploy Backend
    runs-on: linux
    if: github.event.pull_request.merged == true
    steps:
      - name: Checkout code
        run: |
          git clone \
            --depth 1 \
            --branch production \
            https://oauth2:${{ secrets.ERPCORE }}@gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git \
            .
      - name: Restore
        run: dotnet restore Backend/ERPCore.sln
      - name: Publish
        run: |
          rm -rf /tmp/erpcore-deploy
          mkdir -p /tmp/erpcore-deploy
          dotnet publish Backend/ERPCore/ERPCore.csproj \
            -c Release \
            -r linux-x64 \
            --self-contained true \
            -o /tmp/erpcore-deploy
      - name: Stop service
        run: systemctl stop erpcore.service
      - name: Copy to deploy folder
        run: |
          mkdir -p /home/erp/core/publish
          rm -rf /home/erp/core/publish/*
          cp -r /tmp/erpcore-deploy/* /home/erp/core/publish/
      - name: Fix ownership and permissions
        run: |
          chown -R erpuser:erpuser /home/erp/core/publish
          find /home/erp/core/publish -type d -exec chmod 755 {} +
          find /home/erp/core/publish -type f -exec chmod 644 {} +
          chmod +x /home/erp/core/publish/ERPCore
      - name: Restart service
        # ConnectionStrings__DefaultConnection is supplied by the systemd unit on the host
        # (Environment= or EnvironmentFile=), deliberately not committed: appsettings.json ships
        # the key empty and appsettings.Production.json carries no ConnectionStrings section at
        # all. If the unit does not set it, startup throws before serving and the Verify step
        # below fails the job.
        run: systemctl restart erpcore.service
      - name: Verify
        run: |
          # `is-active ... || echo` always exited 0, so a crashed service still reported success.
          # Wait a few seconds first: a startup failure (bad or missing connection string) happens
          # during MigrateAsync, after systemctl restart has already returned.
          sleep 5
          if ! systemctl is-active --quiet erpcore.service; then
            echo "❌ erpcore.service is not running:"
            journalctl -u erpcore.service -n 50 --no-pager
            exit 1
          fi
          echo "✅ Service running"

  build-and-deploy-frontend:
    name: Build & Deploy Frontend
    runs-on: linux
    if: github.event.pull_request.merged == true
    steps:
      - name: Checkout code
        run: |
          git clone \
            --depth 1 \
            --branch production \
            https://oauth2:${{ secrets.ERPCORE }}@gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git \
            .
      - name: Build Docker image
        run: |
          docker build --progress=plain --no-cache \
            -t erpcore-frontend:latest \
            ./Frontend/erp-system
      - name: Stop & remove existing container
        run: |
          docker stop erpcore-frontend 2>/dev/null || true
          docker rm erpcore-frontend 2>/dev/null || true
      - name: Start container
        run: |
          docker run -d \
            --name erpcore-frontend \
            -p 6702:6702 \
            --add-host=host.docker.internal:host-gateway \
            -e BACKEND_ORIGIN=http://host.docker.internal:6701 \
            --restart unless-stopped \
            --memory="512m" \
            --cpus="1.0" \
            --cap-drop ALL \
            --security-opt no-new-privileges \
            erpcore-frontend:latest
      - name: Remove old images
        run: docker image prune -f
      - name: Verify
        run: |
          docker ps --filter name=erpcore-frontend --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" \
            | grep erpcore-frontend && echo "✅ Container running" || echo "❌ Container failed"