name: Deploy Knowledge

permissions:
  actions: read
  contents: read

on:
  workflow_run:
    workflows: ['Build and Push API & Web']
    branches:
      - 'deploy/konwledge'
    types:
      - completed

jobs:
  deploy:
    runs-on: depot-ubuntu-24.04
    if: |
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.head_branch == 'deploy/konwledge'
    steps:
      - name: Wait for KnowledgeFS CI
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        timeout-minutes: 35
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const workflowId = "knowledge-fs-ci.yml";
            const headBranch = context.payload.workflow_run.head_branch;
            const headSha = context.payload.workflow_run.head_sha;
            const deadline = Date.now() + 30 * 60 * 1000;
            const pollIntervalMs = 15 * 1000;

            while (Date.now() < deadline) {
              const { data } = await github.rest.actions.listWorkflowRuns({
                owner: context.repo.owner,
                repo: context.repo.repo,
                workflow_id: workflowId,
                branch: headBranch,
                event: "push",
                head_sha: headSha,
                per_page: 10,
              });
              const run = data.workflow_runs[0];

              if (!run) {
                core.info(`Waiting for ${workflowId} to start for ${headSha}.`);
              } else if (run.status !== "completed") {
                core.info(`Waiting for ${run.html_url}; current status is ${run.status}.`);
              } else if (run.conclusion !== "success") {
                throw new Error(
                  `${workflowId} did not succeed for ${headSha}: ${run.conclusion} (${run.html_url})`,
                );
              } else {
                core.info(`KnowledgeFS CI succeeded for ${headSha}: ${run.html_url}`);
                return;
              }

              await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
            }

            throw new Error(`Timed out waiting for ${workflowId} to succeed for ${headSha}.`);

      - name: Deploy to server
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.SSH_NEW_RAG_HOST }}
          username: ${{ secrets.SSH_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            set -euo pipefail

            deploy_script="$(mktemp)"
            normalized_script="${deploy_script}.normalized"
            cleanup() {
              rm -f "$deploy_script" "$normalized_script"
            }
            trap cleanup EXIT

            cat > "$deploy_script" <<'DIFY_KNOWLEDGE_DEPLOY_SCRIPT'
            ${{ vars.SSH_KNOWLEDGE_SCRIPT || secrets.SSH_KNOWLEDGE_SCRIPT }}
            DIFY_KNOWLEDGE_DEPLOY_SCRIPT

            if [[ ! -s "$deploy_script" ]]; then
              echo "KnowledgeFS deploy script is empty." >&2
              exit 1
            fi

            # GitHub variables and secrets can retain Windows CRLF line endings.
            # Normalize them before Bash parses options such as `set -eu`.
            tr -d '\r' < "$deploy_script" > "$normalized_script"
            mv "$normalized_script" "$deploy_script"
            bash -e -u -o pipefail "$deploy_script"

      - name: Apply KnowledgeFS database migrations
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.SSH_NEW_RAG_HOST }}
          username: ${{ secrets.SSH_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            set -euo pipefail

            mapfile -t knowledge_fs_containers < <(
              docker ps \
                --filter 'label=com.docker.compose.service=knowledge_fs' \
                --format '{{.ID}}'
            )
            if [[ "${#knowledge_fs_containers[@]}" -ne 1 ]]; then
              echo "Expected exactly one running KnowledgeFS container, found ${#knowledge_fs_containers[@]}." >&2
              exit 1
            fi

            docker exec "${knowledge_fs_containers[0]}" node migrate.mjs