#!/usr/bin/env bash
# 06-cicd-setup.sh — Set up Cloud Build trigger + Artifact Registry for CI/CD
# Prerequisites: GitHub repo connected to Cloud Build via GCP Console FIRST:
#   https://console.cloud.google.com/cloud-build/triggers/connect
# Source .env before running: source .env
set -euo pipefail

: "${PROJECT_ID:?Set PROJECT_ID}"
: "${REGION:?Set REGION}"
: "${GITHUB_OWNER:?Set GITHUB_OWNER}"
: "${GITHUB_REPO:?Set GITHUB_REPO}"
: "${ARTIFACT_REPO:?Set ARTIFACT_REPO}"
: "${CLOUD_RUN_SERVICE:?Set CLOUD_RUN_SERVICE}"

BRANCH_PATTERN="^main$"

echo "=== 06: CI/CD Setup for ${PROJECT_ID} ==="

bash "$(dirname "$0")/00-authcheck.sh"

gcloud services enable \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com \
  run.googleapis.com \
  --project="${PROJECT_ID}" --quiet

# Create Artifact Registry repo (idempotent)
if ! gcloud artifacts repositories describe "${ARTIFACT_REPO}" \
    --location="${REGION}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
  gcloud artifacts repositories create "${ARTIFACT_REPO}" \
    --repository-format=docker \
    --location="${REGION}" \
    --project="${PROJECT_ID}" --quiet
  echo "✓ Artifact Registry repo created: ${ARTIFACT_REPO}"
else
  echo "✓ Artifact Registry repo already exists"
fi

gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet

# Grant Cloud Build SA permissions
PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
CB_SA="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"

for ROLE in \
  roles/run.admin \
  roles/iam.serviceAccountUser \
  roles/artifactregistry.writer \
  roles/secretmanager.secretAccessor; do
  gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${CB_SA}" --role="${ROLE}" --quiet
done
echo "✓ Cloud Build SA IAM bindings applied"

# Create Cloud Build trigger
TRIGGER_NAME="${CLOUD_RUN_SERVICE}-main-trigger"
EXISTING=$(gcloud builds triggers list \
  --filter="name=${TRIGGER_NAME}" \
  --format="value(name)" 2>/dev/null | head -1 || true)

if [[ -z "${EXISTING}" ]]; then
  gcloud builds triggers create github \
    --name="${TRIGGER_NAME}" \
    --repo-owner="${GITHUB_OWNER}" \
    --repo-name="${GITHUB_REPO}" \
    --branch-pattern="${BRANCH_PATTERN}" \
    --build-config="cloudbuild.yaml" \
    --project="${PROJECT_ID}" \
    --quiet
  echo "✓ Cloud Build trigger created: ${TRIGGER_NAME}"
else
  echo "✓ Trigger already exists: ${TRIGGER_NAME}"
fi

echo ""
echo "=== 06: CI/CD Setup COMPLETE ==="
echo "  NOTE: GitHub connection must be pre-authorized at:"
echo "  https://console.cloud.google.com/cloud-build/triggers/connect?project=${PROJECT_ID}"
echo "  After first deploy, switch traffic manually:"
echo "  gcloud run services update-traffic ${CLOUD_RUN_SERVICE} --to-latest --region=${REGION}"