name: Deploy EG-BIM QA Production

on:
  workflow_dispatch:

concurrency:
  group: qa-production
  cancel-in-progress: false

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    env:
      DEPLOY_REF: ${{ gitea.ref }}
      DEPLOY_COMMIT_SHA: ${{ gitea.sha }}
      CLOUDFLARE_API_TOKEN: ${{ secrets.PROD_CLOUDFLARE_API_TOKEN }}
      SESSION_SECRET: ${{ secrets.PROD_SESSION_SECRET }}
      ABC_API_KEY: ${{ secrets.PROD_ABC_API_KEY }}
      AUTH_CLIENT_ID: ${{ vars.PROD_AUTH_CLIENT_ID }}
      AUTH_ISSUER: ${{ vars.PROD_AUTH_ISSUER }}
      ABC_API_BASE_URL: ${{ vars.PROD_ABC_API_BASE_URL }}
      ABC_PROJECT_ID: ${{ vars.PROD_ABC_PROJECT_ID }}
      ABC_CHANNEL_ID: ${{ vars.PROD_ABC_CHANNEL_ID }}
      ORG_CONTEXT_ENABLED: ${{ vars.PROD_ORG_CONTEXT_ENABLED }}
      ORG_CONTEXT_API_URL: ${{ vars.PROD_ORG_CONTEXT_API_URL || 'https://app.brsw.kr/api/v1/integrations/org-context' }}
      ORG_CONTEXT_SCOPE_MODE: ${{ vars.PROD_ORG_CONTEXT_SCOPE_MODE }}
      ORG_CONTEXT_EXPOSURE: ${{ vars.PROD_ORG_CONTEXT_EXPOSURE }}
      ORG_CONTEXT_TENANT_IDS: ${{ vars.PROD_ORG_CONTEXT_TENANT_IDS }}
      ORG_CONTEXT_CACHE_TTL_SECONDS: ${{ vars.PROD_ORG_CONTEXT_CACHE_TTL_SECONDS }}
      ORG_CONTEXT_KEY_ID: ${{ secrets.PROD_ORG_CONTEXT_KEY_ID }}
      ORG_CONTEXT_KEY_SECRET: ${{ secrets.PROD_ORG_CONTEXT_KEY_SECRET }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Require main and the selected commit
        shell: bash
        run: |
          set -euo pipefail
          test "$DEPLOY_REF" = "refs/heads/main" || { echo "Production must be deployed from main"; exit 1; }
          test "$(git rev-parse HEAD)" = "$DEPLOY_COMMIT_SHA" || { echo "Checkout does not match the selected commit"; exit 1; }

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Validate production settings
        run: node scripts/deploy-production.mjs --validate-only

      - name: Install dependencies
        run: npm ci --no-fund --no-audit

      - name: Check source and tests
        run: npm run check && npm test

      - name: Verify production organization API
        run: npm run org:verify

      - name: Verify production ABC project and channel access
        run: npm run abc:verify

      - name: Build production Worker without deploying
        run: npm run deploy:production -- --dry-run

      - name: Upload this commit's static files
        shell: bash
        run: bash scripts/upload-r2.sh baron-qa-write wrangler.production.toml "releases/$DEPLOY_COMMIT_SHA"

      - name: Deploy production Worker and secrets
        run: npm run deploy:production

      - name: Verify production HTTP endpoints
        run: npm run production:verify