stages:
  - test
  - sonar
  - deploy

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'
    - if: '$CI_COMMIT_BRANCH == "develop"'

variables:
  VPS_HOST: "141.94.42.172"
  VPS_USER: "ubuntu"
  VPS_PORT: "22"

# ─── Tests ────────────────────────────────────────────────────────────────────

test-backend:
  stage: test
  tags:
    - local
  image: node:22
  script:
    - cd backend && npm install && npm install -D @vitest/coverage-v8 && npx vitest run --reporter=verbose --coverage.enabled --coverage.reporter=lcov
  artifacts:
    paths:
      - backend/coverage/lcov.info
    expire_in: 1 day

test-frontend:
  stage: test
  tags:
    - local
  image: node:22
  script:
    - cd frontend && npm install && npm install -D @vitest/coverage-v8 && npx vitest run --reporter=verbose --coverage.enabled --coverage.reporter=lcov
  artifacts:
    paths:
      - frontend/coverage/lcov.info
    expire_in: 1 day

# ─── SonarQube ────────────────────────────────────────────────────────────────

sonarqube:
  stage: sonar
  tags:
    - local
  image:
    name: sonarsource/sonar-scanner-cli:11
    entrypoint: [""]
  variables:
    SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
    GIT_DEPTH: "0"
  cache:
    policy: pull-push
    key: "sonar-cache-${CI_COMMIT_REF_SLUG}"
    paths:
      - "${SONAR_USER_HOME}/cache"
  script:
    - sonar-scanner -Dsonar.host.url="${SONAR_HOST_URL}" -Dsonar.token="${SONAR_TOKEN}"
  allow_failure: true

# ─── Deploy (main uniquement) ────────────────────────────────────────────────

.deploy_template: &deploy_setup
  stage: deploy
  tags:
    - local
  image: debian:bookworm-slim
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
  before_script:
    - apt-get update -qq && apt-get install -y -qq openssh-client rsync > /dev/null 2>&1
    - eval $(ssh-agent -s)
    - |
      KEY_B64="${OVH_SSH_PRIVATE_KEY_B64:-}"
      if [ -n "${KEY_B64:-}" ] && [ -f "${KEY_B64}" ]; then
        chmod 600 "${KEY_B64}"
        ssh-add "${KEY_B64}"
      elif [ -n "${KEY_B64:-}" ]; then
        printf '%s' "${KEY_B64}" | tr -d '\r\n\t ' | base64 -d > /tmp/ssh_key
        chmod 600 /tmp/ssh_key
        ssh-add /tmp/ssh_key
      else
        echo "ERROR: Missing OVH_SSH_PRIVATE_KEY_B64"
        exit 1
      fi
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - ssh-keyscan -p "$VPS_PORT" "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
    - chmod 600 ~/.ssh/known_hosts

deploy-backend:
  <<: *deploy_setup
  script:
    - rsync -avz --delete --exclude 'node_modules' --exclude '.env' backend/ $VPS_USER@$VPS_HOST:~/iliacloud/backend/
    - scp docker-compose.yml $VPS_USER@$VPS_HOST:~/iliacloud/docker-compose.yml
    - ssh $VPS_USER@$VPS_HOST "cd ~/iliacloud/backend && docker build -t iliacloud-backend:latest ."
    - ssh $VPS_USER@$VPS_HOST "cd ~/iliacloud && docker stack deploy -c docker-compose.yml iliacloud && docker service update --force iliacloud_backend"

deploy-frontend:
  <<: *deploy_setup
  script:
    - rsync -avz --delete --exclude 'node_modules' frontend/ $VPS_USER@$VPS_HOST:~/iliacloud/frontend/
    - ssh $VPS_USER@$VPS_HOST "cd ~/iliacloud/frontend && docker build -t iliacloud-frontend:latest . && docker service update --force iliacloud_frontend"
