name: Pin to IPFS

# On every push to main: pin the new commit's content to the cluster IPFS node
# and republish the stable IPNS key 'randomp2p' to the new CID. The Traefik
# route random.ziemlichoptimal.de -> /ipns/<key> then serves the newest content
# automatically (no DNS or route changes needed).

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  pin:
    runs-on: ubuntu-latest
    steps:
      - name: Install kubectl
        run: |
          set -e
          curl -sSLo /usr/local/bin/kubectl \
            "https://dl.k8s.io/release/$(curl -sSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x /usr/local/bin/kubectl
          kubectl version --client=true

      - name: Write kubeconfig
        run: |
          mkdir -p "$HOME/.kube"
          echo "${{ secrets.PINNER_KUBECONFIG }}" | base64 -d > "$HOME/.kube/config"
          chmod 600 "$HOME/.kube/config"

      - name: Pin commit and republish IPNS
        env:
          SHA: ${{ github.sha }}
        run: |
          set -e
          JOB="pin-$(echo "$SHA" | cut -c1-8)-${{ github.run_number }}"
          IPNS=k51qzi5uqu5dkac07gojwychmyf3uy08q2fkw4glpjw5mfovz91j3m8qpchhwo

          # Create a one-off pin Job in the ipfs namespace.
          kubectl -n ipfs create -f - <<EOF
          apiVersion: batch/v1
          kind: Job
          metadata:
            name: ${JOB}
            namespace: ipfs
            labels: { app: randomp2p-pin }
          spec:
            backoffLimit: 1
            ttlSecondsAfterFinished: 3600
            template:
              spec:
                restartPolicy: Never
                initContainers:
                  - name: clone
                    image: alpine/git:latest
                    command: [sh, -c]
                    args:
                      - |
                        set -e
                        git init /work/repo
                        cd /work/repo
                        git remote add origin https://git.ziemlichoptimal.de/niels/randomp2p.git
                        git fetch --depth 1 origin ${SHA}
                        git checkout FETCH_HEAD
                        sed -i "s#commit/HASH#commit/${SHA}#; s#>HASH<#>$(echo "${SHA}" | cut -c1-8)<#" /work/repo/index.html
                        rm -rf /work/repo/.git
                    volumeMounts:
                      - { name: work, mountPath: /work }
                containers:
                  - name: pin
                    image: ipfs/kubo:v0.34.1
                    command: [sh, -c]
                    args:
                      - |
                        set -e
                        API=/dns4/ipfs.ipfs.svc.cluster.local/tcp/5001
                        CID=\$(ipfs --api=\$API add -Q -r --cid-version 1 /work/repo)
                        echo "PINNED_CID=\$CID"
                        ipfs --api=\$API name publish --key=randomp2p --allow-offline "/ipfs/\$CID"
                        echo "PUBLISHED /ipns/${IPNS} -> /ipfs/\$CID"
                    volumeMounts:
                      - { name: work, mountPath: /work }
                volumes:
                  - { name: work, emptyDir: {} }
          EOF

          echo "Waiting for job ${JOB} to complete..."
          kubectl -n ipfs wait --for=condition=complete "job/${JOB}" --timeout=300s || true

          echo "===== job logs ====="
          kubectl -n ipfs logs "job/${JOB}" --all-containers=true || true

          # Succeed only if the job completed successfully.
          if [ "$(kubectl -n ipfs get job "${JOB}" -o jsonpath='{.status.succeeded}')" = "1" ]; then
            echo "Pin + IPNS publish succeeded."
            kubectl -n ipfs logs "job/${JOB}" | grep -E "PINNED_CID|PUBLISHED" || true
          else
            echo "Pin job did not succeed." >&2
            exit 1
          fi