artifacts/.github/workflows/offline-package-terraform-installer.yaml

name: Build Offline Terraform Installer

on:
  push:
    paths:
      - '.github/workflows/offline-package-terraform-installer.yaml'
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to use/sync (e.g., v1.8.5). Leave empty to use offline-terraform-<run_number>"
        required: false
        type: string
      terraform_version:
        description: "Override Terraform version (e.g., 1.8.5). Leave empty to auto-resolve"
        required: false
        type: string

permissions:
  contents: write

concurrency:
  group: build-offline-terraform
  cancel-in-progress: false

jobs:
  build-offline-installer:
    strategy:
      matrix:
        arch: [amd64, arm64]
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Install deps (curl, jq, unzip)
        run: |
          set -euo pipefail
          sudo apt-get update -y
          sudo apt-get install -y curl jq unzip          

      - name: Resolve Terraform version
        id: resolve
        env:
          OVERRIDE_VERSION: ${{ github.event.inputs.terraform_version }}
        run: script/resolve-terraform-version.sh

      - name: Build offline Terraform package
        env:
          TERRAFORM_VERSION: ${{ steps.resolve.outputs.version }}
          ARCH: ${{ matrix.arch }}
        run: script/build-offline-terraform-package.sh

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: terraform-offline-package-${{ matrix.arch }}
          path: terraform-offline-package-${{ matrix.arch }}.tar.gz
          if-no-files-found: error

  test-offline-installer:
    needs: build-offline-installer
    strategy:
      matrix:
        arch: [amd64, arm64]
    runs-on: ubuntu-latest
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: terraform-offline-package-${{ matrix.arch }}
          path: ./test-dir

      - name: Extract package
        run: |
          set -euo pipefail
          cd test-dir
          tar -xzvf terraform-offline-package-${{ matrix.arch }}.tar.gz          

      - name: Verify Terraform bundle
        env:
          TERRAFORM_VERSION: ${{ needs.build-offline-installer.outputs.version }}
          ARCH: ${{ matrix.arch }}
        run: script/verify-terraform-bundle.sh

  publish-release:
    needs: test-offline-installer
    runs-on: ubuntu-latest
    env:
      TAG_NAME: ${{ github.event.inputs.tag != '' && github.event.inputs.tag || format('offline-terraform-{0}', github.run_number) }}
      RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
      RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
      VPS_HOST: ${{ secrets.VPS_HOST }}
      REMOTE_ROOT: /data/update-server/terraform
    steps:
      - uses: actions/checkout@v4

      - name: Create GitHub Release
        id: create_release
        uses: actions/create-release@v1
        with:
          tag_name: ${{ env.TAG_NAME }}
          release_name: Build ${{ env.TAG_NAME }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Download amd64 artifact
        uses: actions/download-artifact@v4
        with:
          name: terraform-offline-package-amd64
          path: release-artifacts/amd64

      - name: Download arm64 artifact
        uses: actions/download-artifact@v4
        with:
          name: terraform-offline-package-arm64
          path: release-artifacts/arm64

      - name: Upload offline installers to GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ env.TAG_NAME }}
          files: |
            release-artifacts/amd64/terraform-offline-package-amd64.tar.gz
            release-artifacts/arm64/terraform-offline-package-arm64.tar.gz            
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Ensure deps (rsync, ssh)
        run: |
          set -euo pipefail
          sudo apt-get update -y
          sudo apt-get install -y rsync openssh-client          

      - name: Init SSH
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts          

      - name: Rsync release assets to remote
        run: script/rsync-release-assets.sh

  retention:
    name: Remote retention (keep latest 3)
    needs: publish-release
    runs-on: ubuntu-latest
    env:
      RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
      RSYNC_SSH_USER: ${{ secrets.RSYNC_SSH_USER }}
      VPS_HOST: ${{ secrets.VPS_HOST }}
      REMOTE_ROOT: /data/update-server/terraform
    steps:
      - name: Init SSH
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          echo "$RSYNC_SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts          

      - name: Prune old versions on remote (keep 3)
        run: script/prune-remote-versions.sh