name: Test & Deploy
on: push

jobs:
  test:
    name: Test
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: erlef/setup-beam@v1
        id: setup-beam
        with:
          version-type: strict
          version-file: .tool-versions
      - name: Cache deps
        id: cache-deps
        uses: actions/cache@v4
        env:
          cache-name: cache-elixir-deps
        with:
          path: deps
          key: ${{ runner.os }}-otp-${{ steps.setup-beam.outputs.otp-version }}-elixir-${{ steps.setup-beam.outputs.elixir-version }}-mix-${{ env.cache-name }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-otp-${{ steps.setup-beam.outputs.otp-version }}-elixir-${{ steps.setup-beam.outputs.elixir-version }}-mix-${{ env.cache-name }}-

      # Step: Define how to cache the `_build` directory. After the first run,
      # this speeds up tests runs a lot. This includes not re-compiling our
      # project's downloaded deps every run.
      - name: Cache compiled build
        id: cache-build
        uses: actions/cache@v4
        env:
          cache-name: cache-compiled-build
        with:
          path: _build
          key: ${{ runner.os }}-otp-${{ steps.setup-beam.outputs.otp-version }}-elixir-${{ steps.setup-beam.outputs.elixir-version }}-mix-${{ env.cache-name }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-otp-${{ steps.setup-beam.outputs.otp-version }}-elixir-${{ steps.setup-beam.outputs.elixir-version }}-mix-${{ env.cache-name }}-
            ${{ runner.os }}-otp-${{ steps.setup-beam.outputs.otp-version }}-elixir-${{ steps.setup-beam.outputs.elixir-version }}-mix-

      # Step: Conditionally bust the cache when job is re-run.
      # Sometimes, we may have issues with incremental builds that are fixed by
      # doing a full recompile. In order to not waste dev time on such trivial
      # issues (while also reaping the time savings of incremental builds for
      # *most* day-to-day development), force a full recompile only on builds
      # that are retried.
      - name: Clean to rule out incremental build as a source of flakiness
        if: github.run_attempt != '1'
        run: |
          mix deps.clean --all
          mix clean
        shell: sh
      - name: Add Fluxon UI repo
        run: |
          mix hex.repo add fluxon https://repo.fluxonui.com \
            --fetch-public-key $FLUXON_KEY_FINGERPRINT \
            --auth-key $FLUXON_LICENSE_KEY
        env:
          FLUXON_LICENSE_KEY: ${{ secrets.FLUXON_LICENSE_KEY }}
          FLUXON_KEY_FINGERPRINT: ${{ secrets.FLUXON_KEY_FINGERPRINT }}
      - name: Fetch dependencies
        run: mix deps.get
      - name: Check unused dependencies
        run: mix deps.unlock --check-unused
      - name: Check translations
        run: mix gettext.extract --check-up-to-date
      - name: Check formatting
        run: mix format --check-formatted
      - name: Check Credo
        run: mix credo --strict
      - name: Run tests
        run: mix test
        env:
          CLOAK_ENCRYPTION_KEY: f5ol1dJROsm9yi/tvtHiblN8aLH1FUN/obEvUcASx3U=

  deploy:
    needs: test
    runs-on: ubuntu-latest
    environment: production
    if: github.ref == 'refs/heads/main'
    concurrency: deploy-group
    steps:
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build
        uses: docker/build-push-action@v6
        with:
          platforms: linux/amd64
          tags: fullyforged/music_library:latest
          push: true
          cache-from: type=registry,ref=fullyforged/music_library:latest
          cache-to: type=inline
          secrets: |
            "FLUXON_LICENSE_KEY=${{ secrets.FLUXON_LICENSE_KEY }}"
            "FLUXON_KEY_FINGERPRINT=${{ secrets.FLUXON_KEY_FINGERPRINT }}"

      - name: Deploy to Coolify
        run: | 
         curl --request GET '${{ secrets.COOLIFY_WEBHOOK }}' --header 'Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}'

  verify:
    name: Verify
    needs: deploy
    runs-on: ubuntu-24.04
    environment: production
    if: github.ref == 'refs/heads/main'
    concurrency: deploy-group # optional: ensure only one action runs at a time
    steps:
      - uses: actions/checkout@v4
      - uses: gacts/install-hurl@v1
      - name: Wait until instance is up
        run: hurl --test test/healthcheck.hurl --retry 3 --retry-interval 5000
      - name: Run production tests
        run: hurl --test test/prod.hurl
        env:
          HURL_api_token: ${{ secrets.API_TOKEN }}