# push 到 main/master → 渲染密钥 → 写入 Consul → 重启相关 API
# runner: k3s-host（与 api 部署同一台，可访问 ClusterIP + kubectl）
name: Sync Consul Config

on:
  push:
    branches: [master, main]
    paths:
      - "idwms/**"
      - "scripts/**"
      - ".gitea/workflows/sync-consul.yml"
  workflow_dispatch:
    inputs:
      targets:
        description: "同步目标（空=全部；或 admin / common / itfxapi / trackapi，空格分隔）"
        required: false
        default: ""
      restart:
        description: "同步后重启 API（1/0）"
        required: false
        default: "1"

jobs:
  sync:
    runs-on: k3s-host
    steps:
      - name: Checkout and sync
        run: |
          set -euxo pipefail
          export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
          export NAMESPACE=prod
          export RESTART_APIS="${{ gitea.event.inputs.restart || '1' }}"
          if [[ "${{ gitea.event_name }}" == "push" ]]; then
            export RESTART_APIS=1
          fi

          REPO="${{ gitea.repository }}"
          REPO="${REPO:-${{ github.repository }}}"
          SHA="${{ gitea.sha }}"
          SHA="${SHA:-${{ github.sha }}}"
          test -n "$REPO" && [[ "$REPO" == */* ]]
          test -n "$SHA"

          GITEA_HTTP="https://git.ideship.com"
          WORK="/data/ci-build/config"
          GITEA_USER="$(kubectl -n prod get secret kaniko-git -o jsonpath='{.data.GITEA_USER}' | base64 -d)"
          GIT_TOKEN="$(kubectl -n prod get secret kaniko-git -o jsonpath='{.data.GIT_TOKEN}' | base64 -d)"
          GITEA_USER="${GITEA_USER:-gitea}"

          rm -rf "$WORK"
          mkdir -p "$WORK"
          cd "$WORK"
          git init -q
          git remote add origin "${GITEA_HTTP}/${REPO}.git"
          AUTH_B64="$(printf '%s:%s' "$GITEA_USER" "$GIT_TOKEN" | base64 | tr -d '\n\r ')"
          git -c http.extraHeader="Authorization: Basic ${AUTH_B64}" \
            fetch --depth 1 --quiet --no-tags origin "$SHA"
          git checkout --force --quiet FETCH_HEAD

          chmod +x scripts/sync-to-consul.sh
          TARGETS="${{ gitea.event.inputs.targets }}"
          if [[ -n "${TARGETS// /}" ]]; then
            # shellcheck disable=SC2086
            ./scripts/sync-to-consul.sh $TARGETS
          else
            ./scripts/sync-to-consul.sh
          fi