name: Vultr Landing Zone Baseline

on:
  push:
    paths:
      - 'iac_modules/pulumi/vultr/**'
      - 'config/vultr/**'
      - '.github/workflows/iac-pipeline-vultr-landingzone-baseline.yaml'
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      deploy_action:
        description: "Deployment action to execute"
        type: choice
        options:
          - init
          - upgrade
          - backup
          - restore
          - destroy
        default: upgrade
      deploy_dry_run:
        description: "Run deployment steps in dry-run mode"
        type: choice
        options:
          - 'true'
          - 'false'
        default: 'true'

env:
  PULUMI_CI: 'true'
  CONFIG_PATH: config/vultr

jobs:
  preview:
    name: Preview baseline changes
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      - name: Pulumi preview
        uses: pulumi/actions@v4
        with:
          command: preview
          stack-name: vultr/baseline-dev
          work-dir: iac_modules/pulumi/vultr
        env:
          VULTR_API_KEY: ${{ secrets.VULTR_API_KEY }}
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}

  apply:
    name: Apply to production stack
    needs: preview
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      - name: Pulumi up
        uses: pulumi/actions@v4
        with:
          command: up
          stack-name: vultr/baseline-prod
          work-dir: iac_modules/pulumi/vultr
        env:
          VULTR_API_KEY: ${{ secrets.VULTR_API_KEY }}
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}