# push 到 main/master → 渲染密钥 → 写入 Consul → 重启相关 API
# 触发方式与 api/front 一致（不做 paths 过滤，避免「推了却不跑」）
name: Sync Consul Config

on:
  push:
    branches: [master, main]
    paths:
      - "idwms/**"
      - "scripts/**"
      - ".gitea/workflows/sync-consul.yml"
  workflow_dispatch:

jobs:
  sync:
    runs-on: k3s-host
    steps:
      - name: Checkout and sync
        run: |
          set -euxo pipefail
          export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
          export NAMESPACE=prod

          REPO="${{ gitea.repository }}"
          REPO="${REPO:-${{ github.repository }}}"
          SHA="${{ gitea.sha }}"
          SHA="${SHA:-${{ github.sha }}}"
          test -n "$REPO" && [[ "$REPO" == */* ]]
          test -n "$SHA"

          GITEA_HTTP="https://git.ideship.com"
          WORK="/data/ci-build/config"
          GITEA_USER="$(kubectl -n prod get secret kaniko-git -o jsonpath='{.data.GITEA_USER}' | base64 -d)"
          GIT_TOKEN="$(kubectl -n prod get secret kaniko-git -o jsonpath='{.data.GIT_TOKEN}' | base64 -d)"
          GITEA_USER="${GITEA_USER:-gitea}"

          rm -rf "$WORK"
          mkdir -p "$WORK"
          cd "$WORK"
          git init -q
          git remote add origin "${GITEA_HTTP}/${REPO}.git"
          AUTH_B64="$(printf '%s:%s' "$GITEA_USER" "$GIT_TOKEN" | base64 | tr -d '\n\r ')"
          git -c http.extraHeader="Authorization: Basic ${AUTH_B64}" \
            fetch --depth 1 --quiet --no-tags origin "$SHA"
          git checkout --force --quiet FETCH_HEAD

          chmod +x scripts/sync-to-consul.sh
          ./scripts/sync-to-consul.sh