name: Auto-PR Check/Creation and TF/OpenTofu Plan

on:
  workflow_dispatch:
  push:
    branches-ignore:
      - "main"
      - "renovate/**"
    paths:
      - "cloudflare/**"

env:
  OPENTOFU_VERSION: "1.10.6"
  HC_VAULT_VERSION: "1.20.4"
  TEA_VERSION: "0.10.1"

jobs:
  check-and-create-pr:
    name: Check and Create PR
    outputs:
      pr_number: ${{ steps.pr-check-create.outputs.pr_number }}
      pr_url: ${{ steps.pr-check-create.outputs.pr_url }}
      pr_comments_url: ${{ steps.pr-check-create.outputs.pr_comments_url }}
      pr_comment_id: ${{ steps.pr-check-create.outputs.pr_comment_id }}
      pr_comment_uri: ${{ steps.pr-check-create.outputs.pr_comment_uri }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setting Vault Token
        run: echo "VAULT_TOKEN=${{ secrets.VAULT_GITEA_TOKEN }}" >> $GITHUB_ENV

      - name: Gotify Notification - Start
        uses: eikendev/gotify-action@0.0.3
        with:
          gotify_api_base: ${{ secrets.RUNNER_GOTIFY_URL }}
          gotify_app_token: ${{ secrets.RUNNER_GOTIFY_TOKEN }}
          notification_title: "GITEA: PR Check @ Rinoa"
          notification_message: "Checking for existing PR... 🔍"

      - name: PR Check/Creation
        id: pr-check-create
        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
        with:
          url: ${{ secrets.TREZ_GITEA_URL }}
          token: ${{ secrets.BOT_GITEA_TOKEN }}
          pr-label: "opentofu,manual"
          assignee: ${{ github.actor }}

      - name: Gotify Notification - Done
        uses: eikendev/gotify-action@0.0.3
        with:
          gotify_api_base: ${{ secrets.RUNNER_GOTIFY_URL }}
          gotify_app_token: ${{ secrets.RUNNER_GOTIFY_TOKEN }}
          notification_title: "GITEA: PR Check @ Rinoa"
          notification_message: "PR Check done 🎟️"

  plan-approval:
    name: OpenTofu Plan and Approval
    needs: check-and-create-pr
    runs-on: ubuntu-latest
    env:
      PR_NUMBER: ${{ needs.check-and-create-pr.outputs.pr_number }}
      PR_URL: ${{ needs.check-and-create-pr.outputs.pr_url }}
      PR_COMMENTS_URL: ${{ needs.check-and-create-pr.outputs.pr_comments_url }}
      PR_COMMENT_ID: ${{ needs.check-and-create-pr.outputs.pr_comment_id }}
      PR_COMMENT_URI: ${{ needs.check-and-create-pr.outputs.pr_comment_uri }}
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
    outputs:
      tofu-cloudflare-plan: ${{ steps.tofu_plan.outputs.plan-output }}
      approval_status: ${{ steps.tf-plan-approval.outputs.approval_status }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Gotify Notification
        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
        with:
          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
          notification_title: "GITEA: Terraform/OpenTofu"
          notification_message: "Starting plan..."

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1.0.6
        with:
          version: ${{ env.OPENTOFU_VERSION }}
          tofu_wrapper: true

      - name: Generate .env from Hashicorp Vault
        uses: https://git.trez.wtf/Trez/hc-vault-env@main
        with:
          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
          HC_VAULT_AUTH: token
          HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
          HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
          ENV_FILE_NAME: cloudflare/.env

      - name: Export env vars from Vault .env
        id: env-vault-vars
        run: |
          sed -i 's/[\"'\'']//g' cloudflare/.env
          set -a
          source cloudflare/.env
          set +a
          while IFS='=' read -r key value; do
            if [[ -n "$key" ]]; then
              echo "$key=$value" >> $GITHUB_ENV
            fi
          done < cloudflare/.env
          repo_name=$(echo "${{ github.repository }}" | awk -F"/" '{print $2}')
          echo "repo_name=$repo_name" >> "$GITHUB_OUTPUT"

      - name: Run tofu init
        id: tofu-init
        uses: dnogu/tofu-init@v1
        with:
          working-directory: .
          chdir: cloudflare

      - name: Strip ANSI codes
        id: plain-tofu-init
        uses: marcransome/remove-ansi-colors@v1.7.56
        with:
          colored: ${{ steps.tofu-init.outputs.init-output }}

      - name: Tofu PR Commenter
        uses: https://git.trez.wtf/Trez/tf-pr-commenter@main
        env:
          GITEA_API_URL: ${{ gitea.api_url }}
          GITEA_REPOSITORY: ${{ github.repository }}
          GITEA_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ secrets.BOT_GITEA_TOKEN }}
        with:
          commenter_type: init
          commenter_input: ${{ steps.plain-tofu-init.outputs.uncolored }}
          commenter_exitcode: ${{ steps.tofu-init.outputs.exitcode }}
          git_token: ${{ secrets.BOT_GITEA_TOKEN }}
          pr_comments_url: ${{ env.PR_COMMENTS_URL }}
          working_directory: cloudflare

      - name: Tofu Plan
        id: tofu-plan
        continue-on-error: true
        uses: dnogu/tofu-plan@v1
        with:
          working-directory: .
          chdir: cloudflare
          out: cloudflare.tfplan

      - name: Upload Tofu Plan as artifact
        uses: https://github.com/christopherHX/gitea-upload-artifact@v4
        with:
          name: cloudflare-tfplan
          path: cloudflare/cloudflare.tfplan

      - name: Strip ANSI codes
        id: plain-tofu-plan
        uses: marcransome/remove-ansi-colors@v1.7.56
        with:
          colored: ${{ steps.tofu-plan.outputs.plan-output }}

      - name: Tofu PR Commenter
        uses: https://git.trez.wtf/Trez/tf-pr-commenter@main
        env:
          GITEA_API_URL: ${{ gitea.api_url }}
          GITEA_REPOSITORY: ${{ github.repository }}
          GITEA_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ secrets.BOT_GITEA_TOKEN }}
        with:
          commenter_type: plan
          commenter_input: |
            <details><summary>Tofu Plan (click to expand)</summary>

            ```terraform
            ${{ steps.plain-tofu-plan.outputs.uncolored }}
            ```
            </details>
          commenter_exitcode: ${{ steps.tofu-plan.outputs.exitcode }}
          git_token: ${{ secrets.BOT_GITEA_TOKEN }}
          pr_comments_url: ${{ env.PR_COMMENTS_URL }}
          working_directory: cloudflare

      - name: Gotify Notification
        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
        with:
          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
          notification_title: "GITEA: Terraform/OpenTofu"
          notification_message: "Plan completed, awaiting approval..."

      - name: Wait for manual approval
        id: tf-plan-approval
        uses: https://git.trez.wtf/Trez/gitea-manual-approval@main
        with:
          token: ${{ secrets.BOT_GITEA_TOKEN }}
          api_url: ${{ gitea.api_url }}
          repo_owner: ${{ github.repository_owner }}
          repo_name: ${{ github.event.repository.name }}
          reminder_interval: 120
          approvers: "Trez.One,gitea-sonarqube-bot"
          apprise_api_url: ${{ secrets.APPRISE_URL }}
          initial_comment: |
            <details><summary>Tofu Plan (click to expand)</summary>

            ```terraform
            ${{ steps.plain-tofu-plan.outputs.uncolored }}
            ```
            </details>

      - name: Gotify Notification
        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
        with:
          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
          notification_title: "GITEA: Terraform/OpenTofu"
          notification_message: "Plan approved 👍🏽"

  pr-merge:
    name: PR Merge
    needs: [check-and-create-pr, plan-approval]
    env:
      pr_index: ${{ needs.check-and-create-pr.outputs.pr_number }}
    if: github.ref != 'refs/heads/main' && ${{ needs.plan-approval.outputs.approval_status == 'approved' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install tea
        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
        with:
          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
          name: tea
          version: ${{ env.TEA_VERSION }}

      - name: PR Merge
        id: pr_merge
        run: |
          tea login add \
            --name gitea-rinoa \
            --url "${{ secrets.TREZ_GITEA_URL }}" \
            --user gitea-sonarqube-bot \
            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
            --token ${{ secrets.BOT_GITEA_TOKEN }}

          tea login default gitea-rinoa

          echo "Merging PR..."

          tea pr m \
            --repo ${{ github.repository }} \
            --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" \
            --message "Merged by ${{ github.actor }}" ${pr_index}

          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT

      - name: Gotify Notification
        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
        with:
          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
          notification_title: "GITEA: PR Merge Successful"
          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."

  apply:
    name: Apply Tofu Plan
    needs: [plan-approval,pr-merge]
    runs-on: ubuntu-latest
    if: ${{ needs.plan-approval.outputs.approval_status == 'approved' }}
    env:
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download Tofu Plan
        uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
        with:
          name: cloudflare-tfplan
          path: cloudflare/cloudflare.tfplan

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@v1.0.6
        with:
          version: ${{ env.OPENTOFU_VERSION }}
          tofu_wrapper: true

      - name: Generate .env from Hashicorp Vault
        uses: https://git.trez.wtf/Trez/hc-vault-env@main
        with:
          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
          HC_VAULT_AUTH: token
          HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
          HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
          ENV_FILE_NAME: cloudflare/.env

      - name: Export env vars from Vault .env
        id: env-vault-vars
        run: |
          sed -i 's/[\"'\'']//g' cloudflare/.env
          set -a
          source cloudflare/.env
          set +a
          while IFS='=' read -r key value; do
            if [[ -n "$key" ]]; then
              echo "$key=$value" >> $GITHUB_ENV
            fi
          done < cloudflare/.env

      - name: Run tofu init
        id: tofu-init
        uses: dnogu/tofu-init@v1

      - name: Run Tofu Apply
        uses: dnogu/tofu-apply@v1
        with:
          working-directory: .
          chdir: cloudflare
          plan: cloudflare.tfplan