name: Migrate Qdrant snapshot to practice cluster

# One-off, manual (workflow_dispatch only) bridge: snapshots the production
# Qdrant collection (a live, non-disruptive Qdrant operation — this is how
# the original prod migration was done, just in reverse) and relays the
# snapshot files to the isolated k3s practice EC2. Uses the SAME EC2_SSH_KEY
# deploy.yml already has (never exposed to the operator) plus a new
# PRACTICE_SSH_KEY scoped only to the practice box. Delete this workflow
# file once the one-time migration is done — it is not part of the regular
# deploy path.

on:
  workflow_dispatch:

jobs:
  migrate:
    runs-on: ubuntu-latest
    steps:
      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/prod.pem
          chmod 600 ~/.ssh/prod.pem
          ssh-keyscan -H "${{ secrets.EC2_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Snapshot Qdrant collections on production
        run: |
          ssh -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}" '
            set -e
            sudo docker run --rm --network docker_default curlimages/curl -sf -X POST http://qdrant:6333/collections/duocthu_v1/snapshots > /dev/null
            sudo docker run --rm --network docker_default curlimages/curl -sf -X POST http://qdrant:6333/collections/duocthu_v1__manifest/snapshots > /dev/null
            sleep 3
            SNAP=$(sudo docker exec docker-qdrant-1 ls -t /qdrant/storage/snapshots/duocthu_v1/ | head -1)
            SNAPM=$(sudo docker exec docker-qdrant-1 ls -t /qdrant/storage/snapshots/duocthu_v1__manifest/ | head -1)
            sudo docker cp "docker-qdrant-1:/qdrant/storage/snapshots/duocthu_v1/${SNAP}" /tmp/duocthu_v1.snapshot
            sudo docker cp "docker-qdrant-1:/qdrant/storage/snapshots/duocthu_v1__manifest/${SNAPM}" /tmp/duocthu_v1__manifest.snapshot
            sudo chown ubuntu:ubuntu /tmp/duocthu_v1.snapshot /tmp/duocthu_v1__manifest.snapshot
            ls -la /tmp/*.snapshot
          '

      - name: Pull snapshots to the runner
        run: |
          scp -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}:/tmp/duocthu_v1.snapshot" ./duocthu_v1.snapshot
          scp -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}:/tmp/duocthu_v1__manifest.snapshot" ./duocthu_v1__manifest.snapshot
          ls -la ./*.snapshot

      - name: Upload snapshots as a workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: qdrant-snapshots
          path: |
            duocthu_v1.snapshot
            duocthu_v1__manifest.snapshot
          retention-days: 1

      - name: Clean up temp files on production
        if: always()
        run: |
          ssh -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}" 'rm -f /tmp/duocthu_v1.snapshot /tmp/duocthu_v1__manifest.snapshot' || true