name: CD — Backend

on:
  workflow_run:
    workflows: ["CI — Backend"]
    types: [completed]
    branches: [main, develop]
  workflow_dispatch:
    inputs:
      image_tag: { description: 'Image tag (sha-...)', required: true }
      environment:
        description: 'Target environment'
        type: choice
        options: [production, staging]
        default: production

env:
  IMAGE: ghcr.io/mahmoudholding/<repo>/<service>      # all-lowercase, canonical org = mahmoudholding
  VPS_HOST: 136.144.174.219                            # shared VPS — same for all projects
  VPS_USER: sarkoutmahmoud

jobs:
  deploy:
    runs-on: ubuntu-latest
    if: >
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') ||
      github.event_name == 'workflow_dispatch'
    environment:
      name: ${{ github.event.inputs.environment || (github.event.workflow_run.head_branch == 'main' && 'production' || 'staging') }}
    steps:
      - uses: actions/checkout@v4
      - name: Resolve deployment config        # → environment (staging|production), image_tag, namespace
      - name: Setup SSH                         # uses secrets.VPS_SSH_KEY
      - name: Ensure namespace and GHCR pull secret
      - name: Apply SealedSecret for this env   # applies k8s/sealed-secrets/backend-secrets-${env}.yaml DIRECTLY (no sed-rename)
      - name: Copy Helm chart to VPS            # ssh "rm -rf <dst> && mkdir -p <dst>", then scp -r helm/<chart>/ → <dst>
      - name: Helm upgrade                      # heredoc starts with `set -euo pipefail`; cd into the nested chart subdir; helm upgrade --install --atomic --timeout 5m
      - name: Summary                           # GITHUB_STEP_SUMMARY block