---
name: Onboard

"on":
    workflow_dispatch:
        inputs:
            no_cache:
                description: Build container images without the build cache
                type: boolean
                default: false

env:
    UV_LOCKED: "true"
    UV_MANAGED_PYTHON: "true"

jobs:
    users:
        permissions: write-all
        name: users
        runs-on: devops-server
        steps:
            - name: Checkout
              uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Install dependencies
              run: uv sync

            - name: Create/update users
              run: uv --offline run --no-sync --no-progress users
              env:
                  CS_PROJECT_CODE: "${{ vars.CS_PROJECT_CODE }}"
                  DEVOPS_SERVER_INVENTORY_HOSTNAME: "${{ vars.DEVOPS_SERVER_INVENTORY_HOSTNAME }}"
                  VAULT_API_ENDPOINT: "${{ secrets.VAULT_API_ENDPOINT }}"
                  VAULT_API_KEY: "${{ secrets.VAULT_API_KEY }}"
                  VAULT_CA_CERT_BASE64: "${{ secrets.VAULT_CA_CERT_BASE64 }}"
                  VAULT_CLIENT_CERT_BASE64: "${{ secrets.VAULT_CLIENT_CERT_BASE64 }}"
                  VAULT_CLIENT_KEY_BASE64: "${{ secrets.VAULT_CLIENT_KEY_BASE64 }}"

    devpi-users:
        permissions: write-all
        name: devpi-users
        runs-on: devops-server
        steps:
            - name: Checkout
              uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Install dependencies
              run: uv sync

            - name: Create/update devpi users
              run: uv --offline run --no-sync --no-progress devpi-users
              env:
                  CS_PROJECT_CODE: "${{ vars.CS_PROJECT_CODE }}"
                  DEVOPS_SERVER_INVENTORY_HOSTNAME: "${{ vars.DEVOPS_SERVER_INVENTORY_HOSTNAME }}"
                  VAULT_API_ENDPOINT: "${{ secrets.VAULT_API_ENDPOINT }}"
                  VAULT_API_KEY: "${{ secrets.VAULT_API_KEY }}"
                  VAULT_CA_CERT_BASE64: "${{ secrets.VAULT_CA_CERT_BASE64 }}"
                  VAULT_CLIENT_CERT_BASE64: "${{ secrets.VAULT_CLIENT_CERT_BASE64 }}"
                  VAULT_CLIENT_KEY_BASE64: "${{ secrets.VAULT_CLIENT_KEY_BASE64 }}"

    generic-artifacts:
        permissions: write-all
        name: generic-artifacts
        runs-on: devops-server
        steps:
            - name: Checkout
              uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Install dependencies
              run: uv sync

            - name: Upload generic binary artifacts
              run: |+
                  mkdir -p "${DEVOPS_SERVER_BINARY_ARTIFACTS_DIRECTORY}"
                  uv --offline run --no-sync --no-progress generic-artifacts
              env:
                  DEVOPS_SERVER_BINARY_ARTIFACTS_DIRECTORY: >-
                      /devops-server-cicd-runner-shared-data/devops-server-bin-artifacts-temp
                  CS_PROJECT_CODE: "${{ vars.CS_PROJECT_CODE }}"
                  DEVOPS_SERVER_INVENTORY_HOSTNAME: "${{ vars.DEVOPS_SERVER_INVENTORY_HOSTNAME }}"
                  VAULT_API_ENDPOINT: "${{ secrets.VAULT_API_ENDPOINT }}"
                  VAULT_API_KEY: "${{ secrets.VAULT_API_KEY }}"
                  VAULT_CA_CERT_BASE64: "${{ secrets.VAULT_CA_CERT_BASE64 }}"
                  VAULT_CLIENT_CERT_BASE64: "${{ secrets.VAULT_CLIENT_CERT_BASE64 }}"
                  VAULT_CLIENT_KEY_BASE64: "${{ secrets.VAULT_CLIENT_KEY_BASE64 }}"

    containers:
        permissions: write-all
        name: containers
        runs-on: devops-server
        steps:
            - name: Checkout
              uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Install dependencies
              run: uv sync

            - name: Build and publish container images
              run: uv --offline run --no-sync --no-progress containers
              env:
                  CONTAINERS_NO_CACHE: "${{ inputs.no_cache }}"
                  CS_PROJECT_CODE: "${{ vars.CS_PROJECT_CODE }}"
                  DEVOPS_SERVER_INVENTORY_HOSTNAME: "${{ vars.DEVOPS_SERVER_INVENTORY_HOSTNAME }}"
                  VAULT_API_ENDPOINT: "${{ secrets.VAULT_API_ENDPOINT }}"
                  VAULT_API_KEY: "${{ secrets.VAULT_API_KEY }}"
                  VAULT_CA_CERT_BASE64: "${{ secrets.VAULT_CA_CERT_BASE64 }}"
                  VAULT_CLIENT_CERT_BASE64: "${{ secrets.VAULT_CLIENT_CERT_BASE64 }}"
                  VAULT_CLIENT_KEY_BASE64: "${{ secrets.VAULT_CLIENT_KEY_BASE64 }}"

    openapi-clients:
        permissions: write-all
        name: openapi-clients
        runs-on: devops-server
        steps:
            - name: Checkout
              uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Install dependencies
              run: uv sync

            - name: Generate and publish OpenAPI Python clients
              run: uv --offline run --no-sync --no-progress openapi-client
              env:
                  CS_PROJECT_CODE: "${{ vars.CS_PROJECT_CODE }}"
                  DEVOPS_SERVER_INVENTORY_HOSTNAME: "${{ vars.DEVOPS_SERVER_INVENTORY_HOSTNAME }}"
                  VAULT_API_ENDPOINT: "${{ secrets.VAULT_API_ENDPOINT }}"
                  VAULT_API_KEY: "${{ secrets.VAULT_API_KEY }}"
                  VAULT_CA_CERT_BASE64: "${{ secrets.VAULT_CA_CERT_BASE64 }}"
                  VAULT_CLIENT_CERT_BASE64: "${{ secrets.VAULT_CLIENT_CERT_BASE64 }}"
                  VAULT_CLIENT_KEY_BASE64: "${{ secrets.VAULT_CLIENT_KEY_BASE64 }}"

    github-public-mirror:
        permissions: write-all
        name: github-public-mirror
        runs-on: devops-server
        steps:
            - name: Checkout
              uses: github-mirrors/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Install dependencies
              run: uv sync

            - name: Create/update GitHub public mirrors
              run: uv --offline run --no-sync --no-progress github-public-mirror
              env:
                  CS_PROJECT_CODE: "${{ vars.CS_PROJECT_CODE }}"
                  DEVOPS_SERVER_INVENTORY_HOSTNAME: "${{ vars.DEVOPS_SERVER_INVENTORY_HOSTNAME }}"
                  VAULT_API_ENDPOINT: "${{ secrets.VAULT_API_ENDPOINT }}"
                  VAULT_API_KEY: "${{ secrets.VAULT_API_KEY }}"
                  VAULT_CA_CERT_BASE64: "${{ secrets.VAULT_CA_CERT_BASE64 }}"
                  VAULT_CLIENT_CERT_BASE64: "${{ secrets.VAULT_CLIENT_CERT_BASE64 }}"
                  VAULT_CLIENT_KEY_BASE64: "${{ secrets.VAULT_CLIENT_KEY_BASE64 }}"