when:
  - event: push
    branch: main

steps:
  validate:
    image: alpine:latest
    commands:
      - apk add --no-cache docker-cli docker-cli-compose git
      - |
        CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '\.yaml$' || ls *.yaml)
        for f in $CHANGED; do
          [ -f "$f" ] || continue
          docker compose -f "$f" config > /dev/null && echo "  OK $f" || { echo "  FAIL $f"; exit 1; }
        done

  deploy:
    image: alpine:latest
    commands:
      - apk add --no-cache openssh-client git
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
      - rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" *.yaml root@192.168.4.32:/volume1/docker/compose-files/
      - |
        CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '\.yaml$' | sed 's/\.yaml//' || echo "")
        [ -z "$CHANGED" ] && echo "No stacks changed" && exit 0
        for STACK in $CHANGED; do
          ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
            "cd /volume1/docker/compose-files && \
             set -a && [ -f ${STACK}.env ] && . ./${STACK}.env || true && set +a && \
             docker stack deploy -c ${STACK}.yaml ${STACK}" \
            && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }
        done
    secrets: [ ssh_key ]

  verify:
    image: alpine:latest
    commands:
      - apk add --no-cache openssh-client git
      - mkdir -p ~/.ssh
      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
      - |
        CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '\.yaml$' | sed 's/\.yaml//' || echo "")
        [ -z "$CHANGED" ] && exit 0
        sleep 5
        for STACK in $CHANGED; do
          echo "--- $STACK ---"
          ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
            "docker stack ps $STACK --filter desired-state=running --format '  {{.Name}} {{.CurrentState}}'"
        done
    secrets: [ ssh_key ]

  notify-success:
    image: alpine:latest
    commands:
      - apk add --no-cache curl git
      - CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '\.yaml$' | tr '\n' ' ' || echo "unknown")
      - curl -sf -X POST -H 'Content-Type: application/json' -d "{\"title\":\"Swarm Deploy OK\",\"text\":\"${CHANGED}\",\"themeColor\":\"00aa00\"}" "$TEAMS_WEBHOOK" || true
    secrets: [ teams_webhook ]
    when:
      - status: success

  notify-failure:
    image: alpine:latest
    commands:
      - apk add --no-cache curl
      - curl -sf -X POST -H 'Content-Type: application/json' -d "{\"title\":\"Swarm Deploy FAILED\",\"text\":\"${CI_COMMIT_MESSAGE}\",\"themeColor\":\"ff0000\"}" "$TEAMS_WEBHOOK" || true
    secrets: [ teams_webhook ]
    when:
      - status: failure