name: Migrate Qdrant snapshot to practice cluster

# One-off, manual (workflow_dispatch only) bridge: snapshots the production
# Qdrant collection (a live, non-disruptive Qdrant operation — this is how
# the original prod migration was done, just in reverse) and relays the
# snapshot files to the isolated k3s practice EC2. Uses the SAME EC2_SSH_KEY
# deploy.yml already has (never exposed to the operator) plus a new
# PRACTICE_SSH_KEY scoped only to the practice box. Delete this workflow
# file once the one-time migration is done — it is not part of the regular
# deploy path.

on:
  workflow_dispatch:

jobs:
  migrate:
    runs-on: ubuntu-latest
    steps:
      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/prod.pem
          chmod 600 ~/.ssh/prod.pem
          ssh-keyscan -H "${{ secrets.EC2_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Report production Qdrant version
        run: |
          ssh -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}" '
            sudo docker run --rm --network docker_default curlimages/curl -sf http://qdrant:6333/
          '

      - name: Snapshot Qdrant collections on production
        run: |
          ssh -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}" '
            set -e
            snap() {
              collection="$1"; outfile="$2"
              name=$(sudo docker run --rm --network docker_default curlimages/curl -sf -X POST "http://qdrant:6333/collections/${collection}/snapshots" | grep -oP "\"name\":\"\K[^\"]+")
              test -n "$name"
              sudo docker run --rm --network docker_default curlimages/curl -sf "http://qdrant:6333/collections/${collection}/snapshots/${name}" > "$outfile"
            }
            snap duocthu_v1 /tmp/duocthu_v1.snapshot
            snap duocthu_v1__manifest /tmp/duocthu_v1__manifest.snapshot
            sudo chown ubuntu:ubuntu /tmp/duocthu_v1.snapshot /tmp/duocthu_v1__manifest.snapshot
            ls -la /tmp/*.snapshot
          '

      - name: Pull snapshots to the runner
        run: |
          scp -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}:/tmp/duocthu_v1.snapshot" ./duocthu_v1.snapshot
          scp -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}:/tmp/duocthu_v1__manifest.snapshot" ./duocthu_v1__manifest.snapshot
          ls -la ./*.snapshot

      - name: Upload snapshots as a workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: qdrant-snapshots
          path: |
            duocthu_v1.snapshot
            duocthu_v1__manifest.snapshot
          retention-days: 1

      - name: Clean up temp files on production
        if: always()
        run: |
          ssh -i ~/.ssh/prod.pem "ubuntu@${{ secrets.EC2_HOST }}" 'rm -f /tmp/duocthu_v1.snapshot /tmp/duocthu_v1__manifest.snapshot' || true