# CI/CD репозитория загрузок tgit. Шаблон живёт в HSE/tgit: infra/uploads-template/ — правки делать там.
# Бот не даёт менять .sourcecraft/ и .tgit/ из Telegram (SPEC C-16).
on:
  push:
    - workflows: [check-and-deploy]
      filter:
        branches: ["main"]

workflows:
  check-and-deploy:
    settings:
      max_cube_duration: 10m
    tasks:
      - name: check
        cubes:
          # The API doesn't tell which commit a run is for — the bot reads it from this log (ADR-014). Keep it first.
          - name: meta
            image: ghcr.io/astral-sh/uv:0.8-python3.12-bookworm-slim
            script:
              - echo "TGIT_COMMIT_SHA=$SOURCECRAFT_COMMIT_SHA"
          - name: compile
            needs: ["-"]
            image: ghcr.io/astral-sh/uv:0.8-python3.12-bookworm-slim
            script:
              - python -m compileall -q -x '(^|/)\.' .
          - name: lint
            needs: ["-"]
            image: ghcr.io/astral-sh/uv:0.8-python3.12-bookworm-slim
            script:
              - uvx ruff@0.13 check .
          - name: security
            needs: ["-"]
            image: ghcr.io/astral-sh/uv:0.8-python3.12-bookworm-slim
            script:
              - uvx bandit@1.8 -q -r services -ll
          - name: tests
            needs: ["-"]
            image: ghcr.io/astral-sh/uv:0.8-python3.12-bookworm-slim
            script:
              - python .tgit/run_tests.py
      - name: deploy
        needs: [check]
        cubes:
          - name: deploy
            # full (non-slim) image: has git for diffing the pushed commit
            image: ghcr.io/astral-sh/uv:0.8-python3.12-bookworm
            script:
              - python .tgit/changed_services.py > changed.txt
              - cat changed.txt
              # Разворачивает бот сразу после push (tgit-runner, #13); здесь — только список для лога.
              # Когда CI переедет сюда целиком (#11), бот будет ждать зелёного check перед деплоем.
              - 'echo "$(wc -l < changed.txt) service(s) changed — deployed by the bot via tgit-runner"'