# Deploy the shared humanwork-rag (Hayhooks) service to staging or production ECS.
#
#   - push to `staging` (touching rag/** or this pipeline) → auto-deploy to STAGING
#   - push to `main`    (touching rag/** or this pipeline) → auto-deploy to PRODUCTION
#   - workflow_dispatch                                    → deploy the chosen env
#
# Branch → environment is resolved in the `resolve` job (staging→staging, main→prod);
# a workflow_dispatch run overrides with the chosen `environment` input. `dev`
# targets the separate dev environment (Railway) and is ignored here. Promotion
# is dev → staging → main (enforce-promotion-flow.yml).
#
# Internal-only via Cloud Map (humanwork-rag.humanwork.internal:1416 — no public
# ALB). No external health smoke; relies on ECS service stability + the container
# health check (wget http://localhost:1416/status defined in the Terraform module).
#
# Mirrors agent-deploy.yml. The image is built FROM python:3.12-slim (rag/Dockerfile)
# — no GHCR base — so no `packages: read` / GHCR login is needed here.
#
# Required repository config:
#   vars.AWS_APP_DEPLOY_ROLE_ARN_PROD / _STAGING   (repo VARIABLE, not a secret)
#   vars.AWS_REGION
name: Deploy Rag

on:
  push:
    branches: [staging, main]
    paths:
      - "rag/**"
      - ".github/workflows/rag-deploy.yml"
      - ".github/actions/ecs-deploy/**"
  workflow_dispatch:
    inputs:
      environment:
        description: "Target environment"
        type: choice
        default: staging
        options: [staging, prod]
      image_tag:
        description: "Image tag to build/deploy (blank = sha-<short>)"
        type: string
        required: false
        default: ""

concurrency:
  group: deploy-rag-${{ github.event_name == 'workflow_dispatch' && inputs.environment || (github.ref_name == 'main' && 'prod' || 'staging') }}
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  # Resolve the deploy role with explicit if/else so a missing variable
  # hard-fails with an actionable message instead of an `&&/||` expression
  # silently falling back to the other environment's role (which would fail
  # OIDC auth with an opaque error).
  resolve:
    name: Resolve ${{ github.event_name == 'workflow_dispatch' && inputs.environment || (github.ref_name == 'main' && 'prod' || 'staging') }} role
    runs-on: ubuntu-latest
    outputs:
      environment: ${{ steps.r.outputs.environment }}
      role_arn: ${{ steps.r.outputs.role_arn }}
    steps:
      - id: r
        env:
          ENVIRONMENT: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || (github.ref_name == 'main' && 'prod' || 'staging') }}
          ROLE_PROD: ${{ vars.AWS_APP_DEPLOY_ROLE_ARN_PROD }}
          ROLE_STAGING: ${{ vars.AWS_APP_DEPLOY_ROLE_ARN_STAGING }}
        run: |
          set -euo pipefail
          if [ "$ENVIRONMENT" = "prod" ]; then
            ROLE="$ROLE_PROD"
          else
            ROLE="$ROLE_STAGING"
          fi
          UP=$(echo "$ENVIRONMENT" | tr '[:lower:]' '[:upper:]')
          if [ -z "$ROLE" ]; then
            echo "::error::Variable AWS_APP_DEPLOY_ROLE_ARN_${UP} is not configured."
            exit 1
          fi
          {
            echo "environment=$ENVIRONMENT"
            echo "role_arn=$ROLE"
          } >> "$GITHUB_OUTPUT"

  deploy:
    needs: resolve
    runs-on: ubuntu-latest
    environment: ${{ needs.resolve.outputs.environment }}
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/ecs-deploy
        with:
          service_label: rag
          aws_region: ${{ vars.AWS_REGION }}
          ecr_repository: humanwork-${{ needs.resolve.outputs.environment }}-humanwork-rag
          ecs_cluster: humanwork-${{ needs.resolve.outputs.environment }}-cluster
          ecs_service: humanwork-${{ needs.resolve.outputs.environment }}-humanwork-rag
          task_family: humanwork-${{ needs.resolve.outputs.environment }}-humanwork-rag
          container_name: humanwork-rag
          dockerfile: rag/Dockerfile
          build_context: rag
          image_tag: ${{ inputs.image_tag }}
          sentry_project: humanwork-rag
          sentry_environment: ${{ needs.resolve.outputs.environment }}
          deploy_role_arn: ${{ needs.resolve.outputs.role_arn }}
          sentry_auth_token: ${{ secrets.SENTRY_AUTH_TOKEN }}
          sentry_org: ${{ secrets.SENTRY_ORG }}