blumeops/.forgejo/workflows/cv-deploy.yaml

# CV Deploy Workflow
#
# Bumps cv_version in ansible/roles/cv/defaults/main.yml and pushes the change.
# Deployment to indri is manual (runner has no SSH access to indri):
#   mise run provision-indri -- --tags cv
#
# Usage:
#   1. Release a new CV package from the cv repo first
#   2. Go to Actions > Deploy CV > Run workflow
#   3. Enter the version to deploy, or leave as "latest"
#   4. Run the command above on gilbert to apply

name: Deploy CV

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'CV package version to deploy (e.g., v1.0.0, or "latest")'
        required: true
        default: 'latest'
        type: string

jobs:
  deploy:
    runs-on: k8s
    steps:
      - name: Resolve version
        id: version
        run: |
          INPUT_VERSION="${{ inputs.version }}"

          if [ "$INPUT_VERSION" = "latest" ]; then
            echo "Resolving latest CV package version..."
            VERSION=$(curl -s "https://forge.eblu.me/api/v1/packages/eblume?type=generic&q=cv" \
              | jq -r '[.[] | select(.name == "cv")] | sort_by(.version) | last | .version // empty')

            if [ -z "$VERSION" ]; then
              echo "Error: No CV packages found"
              exit 1
            fi
            echo "Resolved latest version: $VERSION"
          else
            VERSION="$INPUT_VERSION"
            if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Error: Version must be in format vX.Y.Z (e.g., v1.0.0)"
              exit 1
            fi
          fi

          # Verify the package exists
          TARBALL="cv-${VERSION}.tar.gz"
          PACKAGE_URL="https://forge.eblu.me/api/packages/eblume/generic/cv/${VERSION}/${TARBALL}"
          if ! curl -fsSL --head "$PACKAGE_URL" > /dev/null 2>&1; then
            echo "Error: Package not found at $PACKAGE_URL"
            echo "Run the 'Release CV' workflow in the cv repo first."
            exit 1
          fi
          echo "Package verified: $PACKAGE_URL"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Bump cv_version in ansible role
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          DEFAULTS_FILE="ansible/roles/cv/defaults/main.yml"

          echo "Bumping cv_version in $DEFAULTS_FILE to ${VERSION}..."
          yq -i ".cv_version = \"${VERSION}\"" "$DEFAULTS_FILE"

          echo "Updated defaults:"
          grep -E "^cv_version:" "$DEFAULTS_FILE"

      - name: Commit release changes
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          git config user.name "Forgejo Actions"
          git config user.email "actions@forge.ops.eblu.me"

          git add ansible/roles/cv/defaults/main.yml

          if git diff --cached --quiet; then
            echo "No changes to commit (already at $VERSION)"
          else
            git commit -m "Update CV release to $VERSION

          [skip ci]"
            git push origin HEAD:main
            echo "Changes committed and pushed"
          fi

      - name: Summary
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          echo "================================================"
          echo "CV version bumped: $VERSION"
          echo "================================================"
          echo ""
          echo "To deploy on indri, run from gilbert:"
          echo "  mise run provision-indri -- --tags cv"
          echo ""
          echo "Then purge the Fly.io proxy cache:"
          echo "  fly ssh console -a blumeops-proxy -C \\"
          echo "    \"sh -c 'rm -rf /tmp/cache && nginx -s reload'\""