name: chant-pr-prod

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

env:
  CHANT_ENV: prod

jobs:
  plan:
    if: github.event_name == 'pull_request'
    runs-on: docker
    container: node:22
    steps:
      - uses: https://code.forgejo.org/actions/checkout@v7
        with:
          fetch-depth: 0
      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
      - name: Plan the members this pull request reaches
        env:
          BASE_SHA: '${{ github.event.pull_request.base.sha }}'
          PR_NUMBER: '${{ github.event.pull_request.number }}'
          GITHUB_TOKEN: '${{ github.token }}'
        run: chant components pr-plan --base "$BASE_SHA" --pr "$PR_NUMBER" --env prod --gate pr-apply --output .chant/pr --forge forgejo
      - name: Keep the plan report
        if: always()
        uses: https://code.forgejo.org/actions/upload-artifact@v3
        with:
          name: chant-pr-plan
          path: .chant/pr
          if-no-files-found: ignore
  apply:
    if: github.event_name == 'push'
    runs-on: docker
    container: node:22
    concurrency:
      group: chant-apply-prod
      cancel-in-progress: false
    steps:
      - uses: https://code.forgejo.org/actions/checkout@v7
        with:
          fetch-depth: 0
      - run: command -v tofu >/dev/null 2>&1 || (curl -fsSL https://get.opentofu.org/install-opentofu.sh -o /tmp/install-opentofu.sh && sh /tmp/install-opentofu.sh --install-method standalone)
      - name: Restore the record of an earlier attempt at this commit
        uses: https://code.forgejo.org/actions/cache/restore@v4
        with:
          path: .chant/pr-resume/pr-apply.json
          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: chant-apply-prod-${{ github.sha }}-
      - name: Apply the plan a reviewer approved
        env:
          BASE_SHA: '${{ github.event.before }}'
          GITHUB_TOKEN: '${{ github.token }}'
        run: chant components pr-apply --base "$BASE_SHA" --env prod --gate pr-apply --output .chant/pr --forge forgejo --require-review --resume .chant/pr-resume/pr-apply.json
      - name: Keep the record for a re-run
        if: always()
        uses: https://code.forgejo.org/actions/cache/save@v4
        with:
          path: .chant/pr-resume/pr-apply.json
          key: chant-apply-prod-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
      - name: Keep the apply report
        if: always()
        uses: https://code.forgejo.org/actions/upload-artifact@v3
        with:
          name: chant-pr-apply
          path: .chant/pr
          if-no-files-found: ignore