name: Validate Ansible

on:
  pull_request:
    paths:
      - "ansible/**"
      - ".github/workflows/validate-ansible.yml"

# Requires these repository secrets:
#   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
#   TAILSCALE_AUDIENCE   — Tailscale federated identity audience
#   SSH_PRIVATE_KEY      — SSH key authorized on target hosts
#   AGE_SECRET_KEY       — age private key for SOPS decryption

jobs:
  discover:
    name: Discover hosts
    runs-on: ubuntu-latest
    outputs:
      hosts: ${{ steps.discover.outputs.hosts }}
    steps:
      - uses: actions/checkout@v6

      - name: Read hosts from inventory
        id: discover
        run: |
          HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
          echo "hosts=$HOSTS" >> "$GITHUB_OUTPUT"

  check:
    needs: discover
    name: Check → ${{ matrix.host }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      pull-requests: write
    strategy:
      matrix:
        host: ${{ fromJson(needs.discover.outputs.hosts) }}
      fail-fast: false
    steps:
      - uses: actions/checkout@v6

      - name: Set up Tailscale
        uses: tailscale/github-action@v4
        with:
          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
          audience: ${{ secrets.TAILSCALE_AUDIENCE }}
          tags: tag:ci

      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
          ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Install tools
        run: |
          pip install ansible
          wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
          sudo dpkg -i /tmp/sops.deb

      - name: Install Ansible collections
        run: ansible-galaxy install -r ansible/requirements.yml

      - name: Decrypt secrets
        env:
          SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
        run: |
          find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
            out="${f/.enc/}"
            sops -d "$f" > "$out"
          done

      - name: Run playbook (check mode)
        id: check
        working-directory: ansible/
        continue-on-error: true
        env:
          ANSIBLE_HOST_KEY_CHECKING: "false"
        run: |
          ansible-playbook deploy.yml --limit "${{ matrix.host }}" --check --diff 2>&1 | tee playbook_output.txt

      - name: Post recap as PR comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const output = fs.readFileSync('ansible/playbook_output.txt', 'utf8');
            const host = '${{ matrix.host }}';
            const recap = output.split('\n').filter(l => l.startsWith('PLAY RECAP') || l.includes(host + ' ')).join('\n');
            const outcome = '${{ steps.check.outcome }}';
            const header = outcome === 'failure'
              ? `## Ansible Check → ${host} — FAILED`
              : `## Ansible Check → ${host}`;
            const body = `${header}\n\`\`\`\n${recap}\n\`\`\``;

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const marker = `## Ansible Check → ${host}`;
            const existing = comments.find(c => c.body.startsWith(marker) || c.body.startsWith(marker + ' —'));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Fail if check failed
        if: steps.check.outcome == 'failure'
        run: exit 1