# 复制到配置仓 .gitea/workflows/sync-consul.yml
# push master → prod Consul；push test → test Consul
name: Sync Consul Config

on:
  push:
    branches: [master, test]

jobs:
  sync:
    runs-on: k3s-host
    steps:
      - name: Checkout and sync
        run: |
          set -euxo pipefail
          REF="${{ gitea.ref_name }}"
          case "$REF" in
            test)   TARGET=test ;;
            master) TARGET=prod ;;
            *)      echo "unsupported branch: $REF"; exit 1 ;;
          esac

          case "$TARGET" in
            test)
              export KUBECONFIG=/etc/rancher/k3s/k3s-test.yaml
              export NAMESPACE=test
              ;;
            *)
              export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
              export NAMESPACE=prod
              ;;
          esac
          if [[ ! -f "$KUBECONFIG" ]]; then
            echo "FAIL: missing KUBECONFIG=$KUBECONFIG host=$(hostname) uid=$(id -u)"
            ls -la /etc/rancher/k3s/ /root/.kube/ 2>/dev/null || true
            exit 1
          fi
          export RESTART_APIS=1

          REPO="${{ gitea.repository }}"
          SHA="${{ gitea.sha }}"
          test -n "$REPO" && [[ "$REPO" == */* ]]
          test -n "$SHA"

          echo "TARGET=$TARGET REF=$REF NAMESPACE=$NAMESPACE"

          GITEA_HTTP="https://git.ideship.com"
          WORK="/data/ci-build/config-${TARGET}"
          GITEA_USER="$(kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n prod get secret kaniko-git -o jsonpath='{.data.GITEA_USER}' | base64 -d)"
          GIT_TOKEN="$(kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n prod get secret kaniko-git -o jsonpath='{.data.GIT_TOKEN}' | base64 -d)"
          GITEA_USER="${GITEA_USER:-gitea}"

          rm -rf "$WORK"
          mkdir -p "$WORK"
          cd "$WORK"
          git init -q
          git remote add origin "${GITEA_HTTP}/${REPO}.git"
          AUTH_B64="$(printf '%s:%s' "$GITEA_USER" "$GIT_TOKEN" | base64 | tr -d '\n\r ')"
          git -c http.extraHeader="Authorization: Basic ${AUTH_B64}" \
            fetch --depth 1 --quiet --no-tags origin "$SHA"
          git checkout --force --quiet FETCH_HEAD

          chmod +x scripts/sync-to-consul.sh
          ./scripts/sync-to-consul.sh