k_deploy_workflows/.gitea/workflows/deploy.yaml

name: Deploy

on:
  workflow_call:
    inputs:
      k8s_dir:
        description: "Override the default k8s directory path (k8s/)"
        required: false
        default: "k8s/"
        type: string
      helmfile_path:
        description: "Override the default helmfile path (hemfile.yaml)"
        required: false
        default: "helmfile.yaml"
        type: string
      skip_helm_deployment:
        description: "Skip Helm deployment even if helmfile.yaml exists"
        required: false
        default: false
        type: boolean
      skip_shared_secrets_deployment:
        description: "Skip shared secrets deployment (e.g. restic backup secret)"
        required: false
        default: false
        type: boolean
      helmfile_env:
        description: "Optional JSON object string of environment variables for Helmfile"
        required: false
        default: "{}"
        type: string
      namespace:
        description: "Override the default namespace (extracted from repository name)"
        required: false
        default: ""
        type: string

jobs:
  detect-service-type:
    runs-on: ubuntu-latest
    outputs:
      has_helmfile: ${{ steps.check-helmfile.outputs.exists }}
      has_k8s: ${{ steps.check-k8s.outputs.exists }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Check if helmfile.yaml exists
        id: check-helmfile
        run: |
          if [ -f "${{ inputs.helmfile_path }}" ]; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Found helmfile.yaml at ${{ inputs.helmfile_path }}"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "No helmfile.yaml found at ${{ inputs.helmfile_path }}"
          fi
      - name: Check if k8s directory exists
        id: check-k8s
        run: |
          if [ -d "${{ inputs.k8s_dir }}" ]; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Found k8s directory at ${{ inputs.k8s_dir }}"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "No k8s directory found at ${{ inputs.k8s_dir }}"
          fi

  deploy-shared-secrets:
    runs-on: ubuntu-latest
    needs: detect-service-type
    if: inputs.skip_shared_secrets_deployment != 'true'
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_actions/.gitea/actions/extract-namespace-from-repo-name@244a64884838c35a5fc0dc42e0b82bb70b253dfc # 0.0.1
        id: namespace
        with:
          repo: ${{ github.repository }}
      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
      - name: Set restic backup secret
        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
        with:
          namespace: ${{ inputs.namespace || steps.namespace.outputs.namespace }}
          secret-name: backupsidecar-secret
          secret-type: generic
          data: |
            {
              "restic_password": "${{ secrets.RESTIC_PASSWORD }}",
              "restic_rest_username": "${{ secrets.RESTIC_REST_USERNAME }}",
              "restic_rest_password": "${{ secrets.RESTIC_REST_PASSWORD }}",
              "gotify_token": "${{ secrets.GOTIFY_TOKEN }}"
            }

  deploy-k8s:
    runs-on: ubuntu-latest
    needs: detect-service-type
    if: needs.detect-service-type.outputs.has_k8s == 'true'
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_actions/.gitea/actions/extract-namespace-from-repo-name@244a64884838c35a5fc0dc42e0b82bb70b253dfc # 0.0.1
        id: namespace
        with:
          repo: ${{ github.repository }}
      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
      - name: Deploy Kubernetes manifests
        uses: azure/k8s-deploy@51ca02a8b7225fbd0924aac359c5b336a5f1e5b4 # v7.0.0
        with:
          action: deploy
          manifests: "${{ inputs.k8s_dir }}"
          strategy: basic
          namespace: ${{ inputs.namespace || steps.namespace.outputs.namespace }}

  deploy-helm:
    runs-on: ubuntu-latest
    needs: detect-service-type
    if: |
      needs.detect-service-type.outputs.has_helmfile == 'true' && 
      needs.detect-service-type.outputs.has_k8s == 'true' && 
      inputs.skip_helm_deployment != 'true'
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_actions/.gitea/actions/extract-namespace-from-repo-name@244a64884838c35a5fc0dc42e0b82bb70b253dfc # 0.0.1
        id: namespace
        with:
          repo: ${{ github.repository }}
      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
        with:
          method: kubeconfig
          kubeconfig: ${{ secrets.KUBECONFIG }}
      - name: Deploy Helm
        uses: helmfile/helmfile-action@1f44bcb43e5fb17ecb2685d8b6081ec5f6aa5fcf # v2.4.7
        with:
          helmfile-args: apply
          namespace: ${{ inputs.namespace || steps.namespace.outputs.namespace }}
        env: ${{ fromJSON(inputs.helmfile_env) }}

  # Summary job that always runs to show what was deployed
  deployment-summary:
    runs-on: ubuntu-latest
    needs: [detect-service-type, deploy-k8s, deploy-helm]
    if: always()
    steps:
      - name: Deployment Summary
        run: |
          echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ "${{ needs.detect-service-type.outputs.has_k8s }}" == "true" ]; then
            echo "✅ **Kubernetes deployment**: Completed" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ **Kubernetes deployment**: Skipped (no k8s/ directory found)" >> $GITHUB_STEP_SUMMARY
          fi

          if [ "${{ needs.detect-service-type.outputs.has_helmfile }}" == "true" ] && [ "${{ inputs.skip_helm_deployment }}" != "true" ]; then
            echo "✅ **Helm deployment**: Completed" >> $GITHUB_STEP_SUMMARY
          elif [ "${{ needs.detect-service-type.outputs.has_helmfile }}" == "true" ] && [ "${{ inputs.skip_helm_deployment }}" == "true" ]; then
            echo "⏭️ **Helm deployment**: Skipped (manually disabled)" >> $GITHUB_STEP_SUMMARY
          else
            echo "⏭️ **Helm deployment**: Skipped (no helmfile.yaml found)" >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Service Type**: ${{ needs.detect-service-type.outputs.has_helmfile == 'true' && 'Helm + Kubernetes' || 'Kubernetes Only' }}" >> $GITHUB_STEP_SUMMARY