name: Build and sync k3s practice images

# Practice-cluster only (readytochat.realvuxbaro.me, ArgoCD-managed on the
# self-hosted k3s box). Does not touch deploy.yml or the production
# EC2/Compose stack — production never pulls a GHCR image and isn't
# ArgoCD-managed at all, so this workflow has no path to affect it.
#
# ArgoCD's Applications already autosync (syncPolicy.automated) — the gap
# this closes is that the image tag they deploy was a static string
# (`:practice`) that nothing ever rebuilt. This tags every build with the
# commit SHA and repoints the Application at it.

on:
  push:
    branches: [master]
    paths:
      - apps/ai-service/**
      - apps/web/**
      - packages/**
      - ingestion/data/verified/drug_entities.json
      - .github/workflows/build-practice-images.yml
      - .github/scripts/sync_practice_argocd.py
  workflow_dispatch:

concurrency:
  group: practice-images
  cancel-in-progress: false

jobs:
  build-and-sync:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push ai-service
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/ai-service/Dockerfile
          push: true
          tags: ghcr.io/baovu2k4/vsf-duocthu-ai-service:${{ github.sha }}
          cache-from: type=gha,scope=practice-ai-service
          cache-to: type=gha,mode=max,scope=practice-ai-service

      - name: Build and push web
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/web/Dockerfile
          push: true
          tags: ghcr.io/baovu2k4/vsf-duocthu-web:${{ github.sha }}
          cache-from: type=gha,scope=practice-web
          cache-to: type=gha,mode=max,scope=practice-web

      - name: Point the practice ArgoCD Application at the new images
        env:
          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
          IMAGE_TAG: ${{ github.sha }}
        run: python3 .github/scripts/sync_practice_argocd.py

      - name: Confirm readytochat is serving the new build
        run: |
          for attempt in $(seq 1 18); do
            code=$(curl -s -o /dev/null -w '%{http_code}' \
              "https://readytochat.realvuxbaro.me/api/history?conversation_id=ci-smoke-${{ github.sha }}")
            if [ "$code" = "200" ]; then
              echo "readytochat.realvuxbaro.me is live on ${{ github.sha }}"
              exit 0
            fi
            sleep 10
          done
          echo "readytochat.realvuxbaro.me did not pick up ${{ github.sha }} within 3 minutes"
          exit 1