name: Sync Helm Chart to helm-charts Repo

on:
  # Trigger after build-and-push workflow completes successfully
  workflow_run:
    workflows: ["Build and Push Container"]
    types:
      - completed
    branches:
      - main
  # Allow manual trigger
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to sync (e.g., 1.2.3). Leave empty to use latest from version.py'
        required: false
        type: string

jobs:
  sync-helm-chart:
    name: Sync Helm Chart to helm-charts Repository
    runs-on: ubuntu-latest
    # Only run if build-and-push succeeded (skip for manual triggers)
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    permissions:
      contents: write

    steps:
      - name: Checkout attstore repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: main  # Always sync from main branch

      - name: Determine version
        id: version
        run: |
          if [ -n "${{ inputs.version }}" ]; then
            # Manual workflow dispatch with version input
            VERSION="${{ inputs.version }}"
          else
            # Extract from version.py (updated by semantic-release)
            VERSION=$(grep -oP "__version__\s*=\s*['\"]\K[0-9]+\.[0-9]+\.[0-9]+" version.py)
          fi
          
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version to sync: $VERSION"

      - name: Update Helm chart version and appVersion
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          
          # Update Chart.yaml with new version
          sed -i "s/^version:.*$/version: ${VERSION}/" helm/attstore/Chart.yaml
          sed -i "s/^appVersion:.*$/appVersion: \"${VERSION}\"/" helm/attstore/Chart.yaml
          
          # Update ONLY the attstore image tag in values files (not PostgreSQL or other images)
          # Match specifically: "image:" section followed by "tag:" within 3 lines
          perl -i -pe 'BEGIN{undef $/;} s/(image:\s+repository:\s+ghcr\.io\/scribe-security\/attstore\s+pullPolicy:\s+\S+\s+tag:\s+)"[^"]*"/$1"'"${VERSION}"'"/smg' helm/attstore/values.yaml
          perl -i -pe 'BEGIN{undef $/;} s/(image:\s+repository:\s+ghcr\.io\/scribe-security\/attstore\s+pullPolicy:\s+\S+\s+tag:\s+)"[^"]*"/$1"'"${VERSION}"'"/smg' helm/attstore/values-production.yaml
          perl -i -pe 'BEGIN{undef $/;} s/(image:\s+repository:\s+ghcr\.io\/scribe-security\/attstore\s+pullPolicy:\s+\S+\s+tag:\s+)"[^"]*"/$1"'"${VERSION}"'"/smg' helm/attstore/values-aws.yaml

      - name: Package Helm chart
        run: |
          helm package helm/attstore -d /tmp/helm-package

      - name: Checkout helm-charts repository
        uses: actions/checkout@v4
        with:
          repository: scribe-security/helm-charts
          token: ${{ secrets.GHCR_GITHUB_RELEASE }}
          path: helm-charts-repo
          fetch-depth: 0

      - name: Setup Git for helm-charts repo
        working-directory: helm-charts-repo
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Create charts directory if not exists
        working-directory: helm-charts-repo
        run: |
          mkdir -p charts

      - name: Copy attstore chart
        run: |
          # Remove old attstore chart if exists
          rm -rf helm-charts-repo/charts/attstore
          
          # Copy new chart
          cp -r helm/attstore helm-charts-repo/charts/

      - name: Update Helm repository index
        working-directory: helm-charts-repo
        run: |
          # Install Helm if not available
          if ! command -v helm &> /dev/null; then
            curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
          fi
          
          # Package all charts and update index
          helm repo index . --url https://scribe-security.github.io/helm-charts

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.GHCR_GITHUB_RELEASE }}
          path: helm-charts-repo
          commit-message: |
            chore: update attstore chart to v${{ steps.version.outputs.version }}
            
            - Update attstore Helm chart to version ${{ steps.version.outputs.version }}
            - Sync from scribe-security/attstore@${{ github.sha }}
            - Image: ghcr.io/scribe-security/attstore:${{ steps.version.outputs.version }}
          branch: update-attstore-v${{ steps.version.outputs.version }}
          delete-branch: true
          title: "Update attstore chart to v${{ steps.version.outputs.version }}"
          body: |
            ## Helm Chart Update: attstore v${{ steps.version.outputs.version }}
            
            This PR updates the `attstore` Helm chart to version **${{ steps.version.outputs.version }}**.
            
            ### Changes
            - ✅ Updated chart version to `${{ steps.version.outputs.version }}`
            - ✅ Updated appVersion to `${{ steps.version.outputs.version }}`
            - ✅ Updated default image tag to `${{ steps.version.outputs.version }}`
            - ✅ Synced all chart templates and values
            - ✅ Updated Helm repository index
            
            ### Source
            - **Repository**: `scribe-security/attstore`
            - **Commit**: `${{ github.sha }}`
            - **Image**: `ghcr.io/scribe-security/attstore:${{ steps.version.outputs.version }}`
            
            ### Testing
            ```bash
            # Test the chart
            helm repo add scribe https://scribe-security.github.io/helm-charts
            helm repo update
            helm search repo scribe/attstore
            
            # Install
            helm install attstore scribe/attstore --version ${{ steps.version.outputs.version }}
            ```
            
            ---
            *Automated sync from attstore repository*
          labels: |
            helm-chart
            automated
            attstore
          reviewers: |
            ${{ github.actor }}