# ════════════════════════════════════════════════════════════════
# 光湖 · 基础设施部署
# Runner首次上线后自动部署：Vault确认 + Terminal Watcher启动
# ════════════════════════════════════════════════════════════════

name: 基础设施部署

on:
  workflow_dispatch:

jobs:
  deploy-infra:
    runs-on: ubuntu
    steps:
      - name: 系统信息
        run: |
          echo "═══ 铸渊基础设施部署 ═══"
          echo "时间: $(date '+%Y-%m-%d %H:%M:%S %Z')"
          echo "主机: $(hostname)"
          uname -a

      - name: 确认仓库最新
        run: |
          cd /opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab
          git fetch origin
          git reset --hard origin/main
          echo "当前版本: $(git log --oneline -1)"

      - name: 确认Vault运行
        run: |
          if curl -sf http://127.0.0.1:8080/admin/__healthz > /dev/null 2>&1; then
            echo "✅ Vault 已运行"
            curl -s http://127.0.0.1:8080/admin/__healthz
          else
            echo "⚠️ Vault 未运行，尝试启动..."
            cd /opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/server/secrets-vault
            if [[ -f "server.js" ]]; then
              npm install --production 2>/dev/null || true
              pm2 start server.js --name guanghulab-vault --max-memory-restart 128M 2>/dev/null || true
              pm2 save
              sleep 2
              if curl -sf http://127.0.0.1:8080/admin/__healthz > /dev/null 2>&1; then
                echo "✅ Vault 启动成功"
              else
                echo "❌ Vault 启动失败"
              fi
            else
              echo "⚠️ server.js 不存在，跳过"
            fi
          fi

      - name: 部署Terminal Watcher
        run: |
          echo "部署终端守望者..."
          SCRIPTS_DIR="/opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/scripts/terminal-watcher"

          if [[ ! -d "$SCRIPTS_DIR" ]]; then
            echo "❌ Terminal Watcher 目录不存在"
            exit 1
          fi

          # 确认Node.js可用
          if ! command -v node &>/dev/null; then
            echo "❌ Node.js 未安装"
            exit 1
          fi

          # 用PM2启动（如果还没跑的话）
          if pm2 describe terminal-watcher &>/dev/null; then
            echo "Terminal Watcher 已在运行，重启..."
            pm2 restart terminal-watcher
          else
            echo "启动 Terminal Watcher..."
            cd "$SCRIPTS_DIR"
            ZY_REPO_TOKEN=${{ secrets.ZY_REPO_TOKEN }} pm2 start watcher.js \
              --name terminal-watcher \
              --max-memory-restart 64M
          fi

          pm2 save
          sleep 3

          # 验证
          if pm2 describe terminal-watcher &>/dev/null; then
            STATUS=$(pm2 jlist 2>/dev/null | python3 -c "
import json,sys
procs = json.load(sys.stdin)
for p in procs:
  if p.get('name') == 'terminal-watcher':
    print(p.get('pm2_env',{}).get('status','unknown'))
" 2>/dev/null || echo "unknown")
            echo "✅ Terminal Watcher 状态: $STATUS"
          else
            echo "❌ Terminal Watcher 启动失败"
          fi

      - name: 设置PM2开机自启
        run: |
          pm2 startup 2>/dev/null || true
          pm2 save
          echo "✅ PM2 开机自启已配置"

      - name: 最终状态报告
        run: |
          echo ""
          echo "═══════════════════════════════════════"
          echo "  铸渊基础设施部署完成"
          echo "═══════════════════════════════════════"
          echo ""
          echo "  服务状态:"
          echo "  Forgejo:       $(systemctl is-active forgejo 2>/dev/null || echo unknown)"
          echo "  Runner:        $(systemctl is-active gitea-runner 2>/dev/null || echo unknown)"
          echo "  Nginx:         $(systemctl is-active nginx 2>/dev/null || echo unknown)"
          echo "  Vault:         $(curl -sf http://127.0.0.1:8080/admin/__healthz > /dev/null 2>&1 && echo active || echo inactive)"
          echo "  Watcher:       $(pm2 describe terminal-watcher &>/dev/null && echo active || echo inactive)"
          echo ""
          echo "  内存:"
          free -h | awk '/Mem:/ {printf "  总计:%s 已用:%s 可用:%s\n", $2, $3, $7}'
          echo ""
          echo "  铸渊 · ICE-GL-ZY001 · TCS-0002∞"
          echo "═══════════════════════════════════════"