deploy.yaml

# deploy.yaml
# Copyright (c) 2025 Affinity7 Consulting Ltd
# Version: v2 (reusable, minimal auth precedence)
# SPDX-License-Identifier: MIT

on:
  workflow_call:
    inputs:
      github_runner:
        required: true
        type: string
      namespace:
        required: true
        type: string
      target_environment:
        description: >
          The environment to deploy to (e.g., `dev`, `qa`, `prod`).

          - If the environment maps to a **single cluster** in `env_map`, this is all you need.
          - If the environment maps to **multiple clusters**, you must also set `target_cluster`.
        required: true
        default: "dev"
        type: string

      # REQUIRED when env has >1 clusters
      target_cluster:
        description: >
          The specific cluster to deploy to when the selected target_environment
          has more than one cluster in `env_map`.

          - For single-cluster environments (like `dev`, `qa`), leave this empty.
          - For multi-cluster environments (like `prod` with both `aks-prod-weu` and `aks-prod-use`),
            you must provide one of the valid cluster names from `env_map`.

          Example: `aks-prod-weu`   
        required: false
        default: ""
        type: string
      ref:
        description: "The github ref to use for checking out files"
        required: false
        type: string
        default: ${{ github.ref || github.sha }}
      delete_first:
        description: "Delete the namespaced app first before deploying it."
        required: false
        type: boolean        
      delete_only:
        description: "Delete ArgoCD app(s) without redeploying"
        required: false
        type: boolean
        default: false
      cd_repo:
        required: true
        type: string
      cd_repo_org:
        required: true
        type: string
      github_environment:
        required: false
        type: string
      # Mode A (single app)
      application:
        required: false
        type: string
      deploy_path:
        description: "The repo path to the deployment files"
        required: false
        type: string
        default: Deployments
      image_tag:
        required: false
        type: string
      image_base_name:
        required: false
        type: string
      image_base_names:
        required: false
        type: string
      overlay_dir:
        required: true
        type: string
        default: ""

      # Mode B (multi app)
      application_details:
        description: >-
          JSON array where each item maps:
          { "name" => application, "images" => image_base_names[], "path" => deploy_path }
          Example:
          [
            {"name":"app1","images":["repo/app1","repo/sidecar"],"path":"services/app1/overlays/prod"},
            {"name":"app2","images":["repo/app2"],"path":"apps/app2/overlays/prod"}
          ]
        required: false
        type: string
        default: ''

      # Environment map (single supported shape)
      env_map:
        description: >-
          ONLY this JSON shape is supported:
          {
            "<env>": {
              "cluster_count": N,
              "clusters": [
                { "cluster": "...", "dns_zone": "...", "container_registry": "...", "uami_map": [...] }
              ]
            }
          }
        required: false
        type: string

      # Argo / misc
      argocd_auth_token:
        required: false
        type: string
      argocd_username:
        required: false
        type: string
      argocd_password:
        required: false
        type: string
      kustomize_version:
        required: false
        type: string
        default: "5.0.1"
      skip_status_check:
        required: false
        default: false
        type: boolean
      insecure_argo:
        required: false
        default: false
        type: boolean
      debug:
        required: false
        type: boolean
        default: false
    secrets:
      CONTINUOUS_DEPLOYMENT_GH_APP_ID:
        required: true
      CONTINUOUS_DEPLOYMENT_GH_APP_PRIVATE_KEY:
        required: true
      ARGOCD_CA_CERT:
        required: false
      ARGOCD_USERNAME:
        required: false
      ARGOCD_PASSWORD:
        required: false

jobs:
  deploy:
    name: >-
      ${{ inputs.target_environment }}${{ inputs.target_cluster != '' && format(' - {0}', inputs.target_cluster) || '' }}
    runs-on: ${{ inputs.github_runner }}
    environment: ${{ inputs.github_environment }}
    outputs:
      cd_path: ${{ steps.cdroot.outputs.cd_root }}
    steps:
    - name: Checkout repo
      if: ${{ inputs.delete_only == false }}
      uses: actions/checkout@v4
      with:
        fetch-depth: 1
        repository: ${{ github.repository }}
        path: source
        ref: ${{ inputs.ref }}


    - name: Report usage metrics (non-blocking)
      uses: actions/github-script@v7
      continue-on-error: true
      timeout-minutes: 0.5
      env:
        USAGE_ENDPOINT: https://gitopsmanager.io/github-action-metrics
      with:
        script: |
          const fetch = global.fetch;
          const endpoint = process.env.USAGE_ENDPOINT;
          if (!endpoint) {
            core.warning('❌ USAGE_ENDPOINT is not defined');
            return;
          }

          const repoFull = process.env.GITHUB_REPOSITORY || "";
          const [org, repo] = repoFull.split("/");

          const payload = {
            org,
            repo,
            action: "deploy", // or "build" etc.
            timestamp: new Date().toISOString(),
          };

          core.info(`📊 Sending metrics: ${JSON.stringify(payload)}`);

          try {
            const resp = await fetch(endpoint, {
              method: "POST",
              headers: { "Content-Type": "application/json" },
              body: JSON.stringify(payload),
            });

            const text = await resp.text(); // read raw body once

            if (resp.ok) {
              core.info(`✅ Usage metrics reported successfully (${resp.status}).`);
              core.info(`🔍 Response body: ${text}`);
            } else {
              core.warning(`⚠️ Metrics report failed: HTTP ${resp.status}`);
              core.warning(`Response body: ${text}`);
            }
          } catch (err) {
            core.warning(`❌ Metrics request threw: ${err.message}`);
          }



    - name: Generate GitHub App token
      id: generate_token
      uses: actions/create-github-app-token@v2
      with:
        app-id: ${{ secrets.CONTINUOUS_DEPLOYMENT_GH_APP_ID }}
        private-key: ${{ secrets.CONTINUOUS_DEPLOYMENT_GH_APP_PRIVATE_KEY }}
        owner: ${{ inputs.cd_repo_org }}
        repositories: ${{ inputs.cd_repo }}



    - name: Checkout reusable workflow repo
      if: ${{ inputs.delete_only == false }}
      uses: actions/checkout@v4
      with:
        repository: gitopsmanager/k8s-deploy
        ref: v2
        path: reusable

    - name: Checkout continuous-deployment repo
      uses: actions/checkout@v4
      with:
        repository: ${{ inputs.cd_repo_org }}/${{ inputs.cd_repo }}
        token: ${{ steps.generate_token.outputs.token }}
        path: continuous-deployment

    - name: Detect cloud
      id: cloud
      if: ${{ inputs.delete_only == false }}
      uses: gitopsmanager/detect-cloud@v1
      with:
        timeout-ms: 800


    - name: Warn if GitHub-hosted (unknown cloud)
      if: ${{ steps.cloud.outputs.provider == 'unknown' && inputs.delete_only == false  }}
      run: |
        echo "⚠️ Running on a GitHub-hosted runner."
        echo "Workload Identity mappings for AWS/Azure self-hosted runners will not apply."

    - name: Import ENV_MAP from runner
      shell: bash
      run: |
        printf "ENV_MAP<<EOF\n%s\nEOF\n" "$ENV_MAP" >> $GITHUB_ENV


    # Strict env_map parsing + cluster selection (with ENV_MAP fallback)
    - name: Load environment config (JSON)
      id: env
      uses: actions/github-script@v7
      env:
        INLINE_ENV_MAP: ${{ inputs.env_map }}   # workflow input (preferred)
        ENV_MAP: ${{ env.ENV_MAP }}            # fallback env var (e.g., injected from ConfigMap on self-hosted)
        ENVIRONMENT: ${{ inputs.target_environment }}
        CLUSTER_IN: ${{ inputs.target_cluster }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const sourceInput = (process.env.INLINE_ENV_MAP || '').trim();
          const sourceEnv   = (process.env.ENV_MAP || '').trim();
          const raw = sourceInput || sourceEnv;

          if (!raw) {
            core.setFailed('❌ No env_map provided. Pass inputs.env_map OR set ENV_MAP environment variable.');
            return;
          }
          core.info(`Using env_map from ${sourceInput ? 'workflow input (inputs.env_map)' : 'ENV_MAP environment variable'}.`);

          let map;
          try { map = JSON.parse(raw); }
          catch (err) { core.setFailed(`❌ env_map is not valid JSON: ${err.message}`); return; }

          const envName   = (process.env.ENVIRONMENT || '').trim();
          const clusterIn = (process.env.CLUSTER_IN || '').trim();

          let selected;

          if (clusterIn) {
            // Cluster override: search ALL clusters across ALL environments
            const allClusters = Object.entries(map)
              .flatMap(([env, val]) => (val.clusters || []).map(c => ({ ...c, __env: env })));

            selected = allClusters.find(c => String(c.cluster).toLowerCase() === clusterIn.toLowerCase());
            if (!selected) {
              const available = allClusters.map(c => `${c.cluster} (env=${c.__env})`);
              core.setFailed(`❌ target_cluster '${clusterIn}' not found. Available: ${available.join(', ')}`);
              return;
            }

            if (selected.__env !== envName) {
              core.warning(`⚠️ target_cluster '${clusterIn}' belongs to env '${selected.__env}', not requested env '${envName}'. Proceeding anyway.`);
            }

            core.info(`Cluster override: using cluster '${selected.cluster}' from env '${selected.__env}'`);
          } else {
            // Normal environment-based selection
            if (!Object.prototype.hasOwnProperty.call(map, envName)) {
              core.setFailed(`❌ Environment '${envName}' not found. Available: ${Object.keys(map).join(', ')}`);
              return;
            }

            const entry = map[envName];
            if (!entry || typeof entry !== 'object' || !Array.isArray(entry.clusters)) {
              core.setFailed(`❌ env_map['${envName}'] must be { cluster_count, clusters: [...] }`);
              return;
            }
            if (entry.clusters.length === 0) {
              core.setFailed(`❌ env_map['${envName}'].clusters is empty`);
              return;
            }
            if (entry.clusters.length > 1) {
              const names = entry.clusters.map(c => c.cluster).filter(Boolean);
              core.setFailed(`❌ '${envName}' has multiple clusters. Provide target_cluster. Options: ${names.join(', ')}`);
              return;
            }

            selected = entry.clusters[0];
            core.info(`Selected single cluster '${selected.cluster}' from env '${envName}'`);
          }

          // Final validation + outputs
          const cluster   = String(selected.cluster || '');
          const dnsZone   = String(selected.dns_zone || '');
          const registry  = String(selected.container_registry || '');
          const uami      = Array.isArray(selected.uami_map) ? selected.uami_map : [];

          if (!cluster) { core.setFailed('❌ Selected cluster name is empty'); return; }
          if (!dnsZone) { core.setFailed(`❌ Cluster '${cluster}' is missing dns_zone`); return; }

          core.setOutput('cluster', cluster);
          core.setOutput('dns_zone', dnsZone);
          core.setOutput('container_registry', registry);
          core.setOutput('uami_map', JSON.stringify(uami));
          core.setOutput('namespace', process.env.NAMESPACE);




    - name: Export CD_ROOT
      id: cdroot
      run: |
        CD_ROOT="continuous-deployment/${{ steps.env.outputs.cluster }}/${{ inputs.namespace }}"
        echo "CD_ROOT=$CD_ROOT" >> "$GITHUB_ENV"
        echo "cd_root=$CD_ROOT" >> "$GITHUB_OUTPUT"

    - name: Export UAMI env vars (uami_name => client_id)
      id: uami
      if: ${{ inputs.delete_only == false }}
      uses: actions/github-script@v7
      env:
        UAMI_JSON: ${{ steps.env.outputs.uami_map }}
        CLUSTER: ${{ steps.env.outputs.cluster }}
      with:
        script: |
          const clusterName = (process.env.CLUSTER || '').trim();

          let arr = [];
          try { arr = JSON.parse(process.env.UAMI_JSON || '[]'); }
          catch { core.setFailed('❌ Selected cluster uami_map is not valid JSON'); return; }

          if (!Array.isArray(arr) || arr.length === 0) {
            core.info('No UAMI entries for selected cluster.');
            core.setOutput("uami_vars", "{}");
            return;
          }

          const seen = new Set();
          const exported = {};

          for (const [i, u] of arr.entries()) {
            let name = String(u.uami_name || '').trim();
            const rg   = String(u.uami_resource_group || '').trim();
            const cid  = String(u.client_id || '').trim();

            if (!name || !cid) {
              core.warning(`Skipping UAMI index ${i}: missing uami_name or client_id.`);
              continue;
            }

            // Remove "<clusterName>-" prefix if present
            const prefix = clusterName + "-";
            if (name.toLowerCase().startsWith(prefix.toLowerCase())) {
              name = name.substring(prefix.length);
            }

            // Replace '-' with '_'
            let varName = name.replace(/-/g, "_");

            // Ensure valid shell identifier
            if (!/^[A-Za-z_]/.test(varName)) varName = `_${varName}`;

            if (seen.has(varName)) {
              core.warning(`Duplicate UAMI var '${varName}' (rg='${rg}'). Skipping duplicate.`);
              continue;
            }

            exported[varName.toLowerCase()] = cid;
            seen.add(varName);
          }

          core.info("UAMI vars exported:");
          core.info(JSON.stringify(exported, null, 2));

          // Set JSON object as step output
          core.setOutput("uami_vars", JSON.stringify(exported));




    # Unify to a single apps[] list for either mode
    - name: Resolve apps (single or multi)
      id: apps
      uses: actions/github-script@v7
      env:
        APP_DETAILS: ${{ inputs.application_details }}
        APPLICATION: ${{ inputs.application }}
        DEPLOY_PATH: ${{ inputs.deploy_path }}
        IMG_ONE: ${{ inputs.image_base_name }}
        IMG_LIST: ${{ inputs.image_base_names }}
      with:
        script: |
          const detailsRaw = (process.env.APP_DETAILS || '').trim();
          let apps = [];

          if (detailsRaw) {
            let arr;
            try { arr = JSON.parse(detailsRaw); }
            catch (e) { core.setFailed(`❌ application_details is not valid JSON: ${e.message}`); return; }

            // Normalize to array if single object
            if (!Array.isArray(arr)) {
              core.info('application_details is a single object → wrapping in an array');
              arr = [arr];
            }

            for (let i = 0; i < arr.length; i++) {
              const it = arr[i] || {};
              const name = String(it.name || '').trim();
              const path = String(it.path || '').trim();
              const images = Array.isArray(it.images) ? it.images.map(String) : [];

              if (!name) { core.setFailed(`❌ application_details[${i}].name is required`); return; }
              if (!path) { core.setFailed(`❌ application_details[${i}].path is required`); return; }

              apps.push({ name, path, images });
            }
          } else {
            // Single app mode (inputs)
            const name = (process.env.APPLICATION || '').trim();
            const path = (process.env.DEPLOY_PATH || '').trim();
            const images = [];

            if ((process.env.IMG_ONE || '').trim()) {
              images.push(process.env.IMG_ONE.trim());
            }
            if ((process.env.IMG_LIST || '').trim()) {
              for (const s of process.env.IMG_LIST.split(',').map(x => x.trim()).filter(Boolean)) {
                images.push(s);
              }
            }

            if (!name) { core.setFailed('❌ application is required when application_details is not provided'); return; }
            if (!path) { core.setFailed('❌ deploy_path is required when application_details is not provided'); return; }

            apps.push({ name, path, images });
          }

          core.setOutput('apps', JSON.stringify(apps));
          core.setOutput('count', String(apps.length));




    - name: Download Nunjucks UMD bundle
      if: ${{ inputs.delete_only == false }}
      run: |
        curl -sSL https://cdnjs.cloudflare.com/ajax/libs/nunjucks/3.2.4/nunjucks.min.js -o nunjucks.js


    - name: Render manifests with Nunjucks (Jinja2-style)
      id: render
      if: ${{ inputs.delete_only == false }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CLUSTER_NAME: ${{ steps.env.outputs.cluster }}
        DNS_ZONE: ${{ steps.env.outputs.dns_zone }}
        NAMESPACE: ${{ inputs.namespace }}
        APPLICATION_DEFAULT: ${{ inputs.application }}
        CONTAINER_REGISTRY: ${{ steps.env.outputs.container_registry }}
        UAMI_VARS: ${{ steps.uami.outputs.uami_vars }}
      with:
        script: |
          const fs = require('fs');
          const path = require('path');
          const nunjucks = require('./nunjucks.js');

          const apps = JSON.parse(process.env.APPS || '[]');
          core.info(`📝 Apps to render: ${apps.map(a => a.name).join(', ')}`);

          let dirs = [];

          // Base vars
          const vars = {
            cluster_name: process.env.CLUSTER_NAME,
            dns_zone: process.env.DNS_ZONE,
            zone_nm: process.env.DNS_ZONE,
            namespace: process.env.NAMESPACE,
          };
          core.info(`🌍 Base vars: ${JSON.stringify(vars)}`);

          // Merge in UAMI vars (client IDs keyed by uami_name)
          try {
            const uamiVars = JSON.parse(process.env.UAMI_VARS || '{}');
            Object.assign(vars, uamiVars);
            core.info(`🔑 Injected UAMI vars: ${Object.keys(uamiVars).join(', ')}`);
          } catch (err) {
            core.warning(`⚠️ Could not parse UAMI_VARS: ${err.message}`);
          }

          nunjucks.configure({ autoescape: false });

          function listFiles(dir) {
            return fs.readdirSync(dir, { withFileTypes: true })
              .flatMap(e => {
                const full = path.join(dir, e.name);
                return e.isDirectory() ? listFiles(full) : [full];
              });
          }

          for (const app of apps) {
            const srcDir = path.join('source', app.path);
            core.startGroup(`📂 Processing app=${app.name} path=${app.path} → srcDir=${srcDir}`);
            dirs.push(srcDir);

            if (!fs.existsSync(srcDir)) {
              core.warning(`⚠️ Source dir not found for app '${app.name}' at ${srcDir}`);
              core.endGroup();
              continue;
            }

            const files = listFiles(srcDir);
            core.info(`Found ${files.length} files for app '${app.name}'`);
            files.forEach(f => core.info("  - " + f));

            for (const f of files) {
              if (/\.(ya?ml|json)$/i.test(f) && !/notemplate\.ya?ml$/i.test(f)) {
                const template = fs.readFileSync(f, 'utf8');
                const rendered = nunjucks.renderString(template, vars);
                fs.writeFileSync(f, rendered, 'utf8');

                // Detect unresolved placeholders
                if (rendered.includes("{{")) {
                  core.warning(`⚠️ Unresolved placeholders remain in ${f}`);
                }

                core.info(`✅ Rendered ${f}`);
              } else {
                core.debug(`Skipping non-YAML/JSON file: ${f}`);
              }
            }
            core.endGroup();
          }

          return dirs.join("\n");



    - name: Copy manifests to CD repo
      id: copy
      if: ${{ inputs.delete_only == false }}
      uses: actions/github-script@v7
      env:
        CLUSTER_NAME: ${{ steps.env.outputs.cluster }}
        NAMESPACE: ${{ inputs.namespace }}
        RENDERED_DIRS: ${{ steps.render.outputs.result }}
        APPS: ${{ steps.apps.outputs.apps }}
      with:
        script: |
          const fs = require('fs');
          const path = require('path');
          const { execSync } = require('child_process');

          const cluster = process.env.CLUSTER_NAME;
          const namespace = process.env.NAMESPACE;
          const renderedDirs = (process.env.RENDERED_DIRS || '').trim().split('\n').filter(Boolean);
          const apps = JSON.parse(process.env.APPS || '[]');

          // ✅ Copy into the continuous-deployment repo
          const cdRoot = path.join('continuous-deployment', cluster, namespace);
          const cdRootRel = path.join(cluster, namespace);
          fs.mkdirSync(cdRoot, { recursive: true });

          // assume apps[] order matches renderedDirs[] order
          renderedDirs.forEach((dir, i) => {
            const app = apps[i];
            if (!app) return;

            const destDir = path.join(cdRoot, app.name);

            // Delete just the app’s directory first
            if (fs.existsSync(destDir)) {
              console.log(`Removing old directory for app ${app.name}: ${destDir}`);
              execSync(`rm -rf "${destDir}"`);
            }

            fs.mkdirSync(destDir, { recursive: true });
            console.log(`Copying ${dir} -> ${destDir}`);
            execSync(`cp -r "${dir}/." "${destDir}/"`, { stdio: 'inherit' });
          });

          core.setOutput('cd_path', cdRoot);
          core.setOutput('cd_path_rel', cdRootRel);


    - name: Create JSON for cluster restore
      id: create-json
      uses: actions/github-script@v7
      env:
        # use resolved cluster and namespace from earlier step
        CLUSTER: ${{ steps.env.outputs.cluster }}
        NAMESPACE: ${{ steps.env.outputs.namespace || inputs.namespace }}
        APPS: ${{ steps.apps.outputs.apps }}
        CD_REPO: ${{ inputs.cd_repo }}
        CD_REPO_ORG: ${{ inputs.cd_repo_org }}
      with:
        script: |
          const fs = require('fs');
          const path = require('path');

          const workspace = process.env.GITHUB_WORKSPACE;
          const cluster = process.env.CLUSTER;
          const namespace = process.env.NAMESPACE || 'default';
          const apps = JSON.parse(process.env.APPS || '[]');

          if (!cluster) {
            core.setFailed("❌ Cluster name not resolved from environment config");
            return;
          }

          if (apps.length === 0) {
            core.warning("⚠️ No applications found — skipping create.json generation");
            return;
          }

          for (const a of apps) {
            // Absolute path inside the checked-out CD repo
            const outputDir = path.join(workspace, 'continuous-deployment', cluster, namespace, a.name);
            fs.mkdirSync(outputDir, { recursive: true });

            const payload = {
              cluster,
              namespace,
              applications: [
                {
                  name: a.name,
                  repo: `https://github.com/${process.env.CD_REPO_ORG}/${process.env.CD_REPO}`,
                  overlay_dir: a.path
                }
              ]
            };

            const outputFile = path.join(outputDir, 'create.json');
            fs.writeFileSync(outputFile, JSON.stringify(payload, null, 2));
            core.info(`🧾 Wrote ${outputFile} for ${a.name} → ${a.path}`);
          }

          core.info(`✅ Finished writing create.json for ${apps.length} app(s)`);




    - name: Setup Kustomize
      if: ${{ inputs.delete_only == false }}
      uses: imranismail/setup-kustomize@v2
      with:
        kustomize-version: ${{ inputs.kustomize_version }}

    - name: Patch image tag(s) (per app)
      if: ${{ inputs.image_tag != '' && inputs.delete_only == false  }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_PATH: ${{ steps.copy.outputs.cd_path }}
        IMAGE_TAG: ${{ inputs.image_tag }}
        OVERLAY_DIR: ${{ inputs.overlay_dir }}
        CONTAINER_REGISTRY: ${{ steps.env.outputs.container_registry }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          const overlayDir = (process.env.OVERLAY_DIR || '').trim();
          const registry = process.env.CONTAINER_REGISTRY.replace(/\/+$/, ''); // strip trailing slash if any

          for (const app of apps) {
            // Normalized layout: just app.name (+ overlays if defined)
            const base = overlayDir
              ? `${process.env.CD_PATH}/${app.name}/overlays/${overlayDir}`
              : `${process.env.CD_PATH}/${app.name}`;

            if ((app.images || []).length === 0) continue;

            for (const img of app.images) {
              // full replacement: <registry>/<image>:<tag>
              const newImage = `${registry}/${img}:${process.env.IMAGE_TAG}`;
              execSync(
                `bash -lc 'cd "${base}" && kustomize edit set image "${img}=${newImage}"'`,
                { stdio: 'inherit' }
              );
            }
          }

    - name: Replace old Traefik CRD API version
      if: ${{ inputs.delete_only == false }}
      run: |
        echo "🔎 Replacing traefik.containo.us/v1alpha1 → traefik.io/v1alpha1"
        find "${{ steps.copy.outputs.cd_path }}" -type f \( -name "*.yaml" -o -name "*.yml" \) \
          -exec sed -i 's#traefik\.containo\.us/v1alpha1#traefik.io/v1alpha1#g' {} +


    - name: Upload CD repo manifests
      if: ${{ always() && inputs.delete_only == false }}
      uses: actions/upload-artifact@v4
      with:
        name: templated-source-manifests-${{ steps.env.outputs.cluster }}-${{ fromJSON(steps.apps.outputs.apps)[0].name }}
        path: ${{ steps.copy.outputs.cd_path }}/${{ fromJSON(steps.apps.outputs.apps)[0].name }}


    - name: Debug structure
      if: ${{ inputs.debug && inputs.delete_only == false }}
      run: find "${{ steps.copy.outputs.cd_path }}" || echo "Nothing copied!"

   - name: Run kustomize build (concat per app)
      id: kustomize
      if: ${{ inputs.delete_only == false }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_PATH: ${{ steps.copy.outputs.cd_path }}
        OVERLAY_DIR: ${{ inputs.overlay_dir }}
      with:
        script: |
          const { execSync } = require('child_process');
          const fs = require('fs');
          const apps = JSON.parse(process.env.APPS || '[]');
          const overlayDir = (process.env.OVERLAY_DIR || '').trim();
          const outFile = `${process.env.GITHUB_WORKSPACE}/build-output.yaml`;

          fs.writeFileSync(outFile, '');
          let first = true;

          for (const app of apps) {
            const dir = overlayDir
              ? `${process.env.CD_PATH}/${app.name}/overlays/${overlayDir}`
              : `${process.env.CD_PATH}/${app.name}`;

            const yaml = execSync(`bash -lc 'cd "${dir}" && kustomize build --load-restrictor=LoadRestrictionsNone .'`, { encoding: 'utf8' });
            fs.appendFileSync(outFile, (first ? '' : '\n---\n') + yaml);
            first = false;
          }

          return outFile;



    - name: Upload built manifest as artifact
      if: ${{ always() && inputs.delete_only == false }}
      uses: actions/upload-artifact@v4
      with:
        name: built-kustomize-manifest-${{ steps.env.outputs.cluster }}-${{ fromJSON(steps.apps.outputs.apps)[0].name }}
        path: build-output.yaml



    - name: Commit and push to temp branch
      id: commit_deploy
      if: ${{ inputs.delete_only == false }}
      run: |
        set -euo pipefail
        cd continuous-deployment

        echo "🔎 Debug: Current working directory = $(pwd)"
        git remote -v

        git config user.name "k8s-deploy"
        git config user.email "actions@gitopsmanager.com"

        echo "🔎 Debug: Adding files from: ${{ steps.copy.outputs.cd_path_rel }}/"
        ls -la "${{ steps.copy.outputs.cd_path_rel }}/" || echo "⚠️ Directory not found"

        git add -A "${{ steps.copy.outputs.cd_path_rel }}/"

        echo "🔎 Debug: Status after staging:"
        git status --short || true
        git diff --cached --stat || true

        if git diff --cached --quiet; then
          echo "⚠️ No changes detected — creating empty commit"
          git commit --allow-empty -m "No-op deploy commit for ${{ fromJSON(steps.apps.outputs.apps)[0].name }} at $(date -u)"
        else
          git commit -m "Deploy to ${{ steps.env.outputs.cluster }}/${{ inputs.namespace }} for ${{ fromJSON(steps.apps.outputs.apps)[0].name }}"
        fi

        branch="deploy-${{ steps.env.outputs.cluster }}-${{ inputs.namespace }}-${{ fromJSON(steps.apps.outputs.apps)[0].name }}-$(date +%s)"
        echo "🔎 Debug: Branch to push = $branch"

        git log -1 --oneline

        git push --verbose origin HEAD:"$branch" || { echo "❌ git push failed"; exit 1; }

        git ls-remote origin "refs/heads/$branch" || echo "⚠️ Branch not found on remote"

        echo "branch=$branch" >> "$GITHUB_OUTPUT"
      env:
        GIT_TOKEN: ${{ steps.generate_token.outputs.token }}


    - name: Simple retrying API-based squash merge (deploy)
      if: ${{ inputs.delete_only == false }}
      uses: actions/github-script@v7
      with:
        github-token: ${{ steps.generate_token.outputs.token }}
        script: |
          const owner = process.env.CD_REPO_ORG;
          const repo = process.env.CD_REPO;
          const branch = process.env.BRANCH;
          const appName = process.env.APP_NAME;

          async function wait(ms) { return new Promise(r => setTimeout(r, ms)); }

          const fixedRetries = 10;   // 2s interval
          const randomRetries = 20;  // 1–7.5s randomized
          const maxRetries = fixedRetries + randomRetries;
          let prNumber = null;
          let merged = false;

          try {
            // --- Detect base branch ---
            const { data: repoInfo } = await github.rest.repos.get({ owner, repo });
            const baseBranch = repoInfo.default_branch;
            core.info(`ℹ️ Default branch = ${baseBranch}`);

            // --- Create PR ---
            const { data: pr } = await github.rest.pulls.create({
              owner,
              repo,
              head: branch,
              base: baseBranch,
              title: `Deploy ${appName} to ${process.env.CLUSTER}/${process.env.NAMESPACE}`,
              body: "Automated deployment update."
            });
            prNumber = pr.number;
            core.info(`✅ Opened PR #${pr.number}`);

            // --- Attempt merge loop ---
            for (let attempt = 1; attempt <= maxRetries; attempt++) {
              try {
                await github.rest.pulls.merge({
                  owner,
                  repo,
                  pull_number: pr.number,
                  merge_method: "squash"
                });
                core.info(`✅ Squash-merged PR #${pr.number} on attempt ${attempt}`);
                merged = true;
                break;
              } catch (err) {
                const msg = err.message || "";
                core.warning(`⚠️ Merge attempt ${attempt} failed: ${msg}`);

                // Hard conflict — same-file edits — fail immediately
                if (/conflict|cannot.*merge.*due to conflicts/i.test(msg)) {
                  core.setFailed(`❌ Real merge conflict detected for PR #${pr.number}.`);
                  break;
                }

                // Otherwise, retry (transient base-modified/unknown state)
                if (attempt <= fixedRetries) {
                  await wait(2000); // first 10 tries = fixed 2s
                } else {
                  const delay = 1000 + Math.random() * 6500; // 1–7.5s
                  core.info(`⏳ Retrying in ${(delay / 1000).toFixed(1)}s...`);
                  await wait(delay);
                }
              }
            }

            if (!merged) {
              core.setFailed(`❌ Could not squash-merge PR #${pr.number} after ${maxRetries} attempts.`);
            }

          } catch (err) {
            core.setFailed(`❌ Error during deploy PR merge process: ${err.message || err}`);
          } finally {
            // --- Always cleanup ---
            if (prNumber) {
              if (!merged) {
                core.info(`🧹 Cleanup: leaving PR #${prNumber} open as it failed and deleting branch '${branch}'...`);
              }
              // --- Guard protected branches from deletion ---
              const protectedBranches = ["main", "master"];
              if (protectedBranches.includes(branch)) {
                core.warning(`🚫 Skipping deletion of protected branch '${branch}'.`);
              } else {
                try {
                  await github.rest.git.deleteRef({
                    owner, repo, ref: `heads/${branch}`
                  });
                  core.info(`🗑️ Deleted branch '${branch}'.`);
                } catch (e) {
                  core.warning(`⚠️ Could not delete branch '${branch}': ${e.message}`);
                }
              }
            }
          }
      env:
        CD_REPO_ORG: ${{ inputs.cd_repo_org }}
        CD_REPO: ${{ inputs.cd_repo }}
        BRANCH: ${{ steps.commit_deploy.outputs.branch }}
        CLUSTER: ${{ steps.env.outputs.cluster }}
        NAMESPACE: ${{ inputs.namespace }}
        APP_NAME: ${{ fromJSON(steps.apps.outputs.apps)[0].name }}




    - name: Resolve ArgoCD auth
      id: resolve_auth
      env:
        IN_TOKEN: ${{ inputs.argocd_auth_token }}
        IN_USER: ${{ inputs.argocd_username }}
        IN_PASS: ${{ inputs.argocd_password }}
        SEC_USER: ${{ secrets.ARGOCD_USERNAME }}
        SEC_PASS: ${{ secrets.ARGOCD_PASSWORD }}
      run: |
        set -euo pipefail
        if [ -n "${IN_TOKEN:-}" ]; then
          echo "mode=token" >> "$GITHUB_OUTPUT"
          echo "token=$IN_TOKEN" >> "$GITHUB_OUTPUT"
        elif [ -n "${IN_USER:-}" ] && [ -n "${IN_PASS:-}" ]; then
          echo "mode=basic" >> "$GITHUB_OUTPUT"
          echo "username=$IN_USER" >> "$GITHUB_OUTPUT"
          echo "password=$IN_PASS" >> "$GITHUB_OUTPUT"
        elif [ -n "${SEC_USER:-}" ] && [ -n "${SEC_PASS:-}" ]; then
          echo "mode=basic" >> "$GITHUB_OUTPUT"
          echo "username=$SEC_USER" >> "$GITHUB_OUTPUT"
          echo "password=$SEC_PASS" >> "$GITHUB_OUTPUT"
        else
          echo "❌ No ArgoCD auth provided."
          exit 1
        fi

    - name: Debug ARGOCD_CA_CERT presence
      run: |
        if [ -z "${ARGOCD_CA_CERT}" ]; then
          echo "❌ ARGOCD_CA_CERT is not set"
        else
          echo "✅ ARGOCD_CA_CERT is set (length: ${#ARGOCD_CA_CERT})"
        fi
      shell: bash
      env:
        ARGOCD_CA_CERT: ${{ secrets.ARGOCD_CA_CERT }}



    - name: Set ArgoCD connection (token & URLs)
      id: argocd_conn
      uses: actions/github-script@v7
      env:
        MODE: ${{ steps.resolve_auth.outputs.mode }}
        TOKEN: ${{ steps.resolve_auth.outputs.token }}
        USERNAME: ${{ steps.resolve_auth.outputs.username }}
        PASSWORD: ${{ steps.resolve_auth.outputs.password }}
        ARGOCD_CA_CERT: ${{ secrets.ARGOCD_CA_CERT }}
        CLUSTER: ${{ steps.env.outputs.cluster }}
        DNS_ZONE: ${{ steps.env.outputs.dns_zone }}
        INSECURE_ARGO: ${{ inputs.insecure_argo }}
      with:
        script: |
          const { execSync } = require('child_process');
          const fs = require('fs');
          const cluster = process.env.CLUSTER;
          const dnsZone = process.env.DNS_ZONE;
          const argocdUrl = `https://${cluster}-argocd-argocd-web-ui.${dnsZone}`;

          // TLS flags for curl
          let curlSslFlags = "";
          if (String(process.env.INSECURE_ARGO) === "true") {
            curlSslFlags = "-k";
            core.warning("⚠️ Using insecure connection (curl -k).");
          } else if (process.env.ARGOCD_CA_CERT) {
            let cert = process.env.ARGOCD_CA_CERT;
            if (cert.includes('\\n')) cert = cert.replace(/\\n/g, '\n');
            fs.writeFileSync('/tmp/argocd-ca.crt', cert);
            curlSslFlags = "--cacert /tmp/argocd-ca.crt";
            core.info("✅ Using provided CA cert with curl.");
          }

          let finalToken = process.env.TOKEN;

          if (process.env.MODE !== "token") {
            const body = JSON.stringify({ username: process.env.USERNAME, password: process.env.PASSWORD });
            const cmd = `curl -s ${curlSslFlags} -X POST "${argocdUrl}/api/v1/session" -H "Content-Type: application/json" -d '${body.replace(/'/g,"'\\''")}'`;
            core.info(`🔐 Running: curl ... (hidden password)`);
            const resp = execSync(cmd).toString();
            try {
              finalToken = JSON.parse(resp).token;
            } catch {
              core.error(`Response: ${resp}`);
              core.setFailed("❌ Failed to parse ArgoCD session response");
              return;
            }
          }

          if (!finalToken) {
            core.setFailed("❌ Failed to obtain ArgoCD token.");
            return;
          }

          core.info("✅ Successfully obtained ArgoCD token.");
          core.setOutput('argocd_url', argocdUrl);
          core.setOutput('curl_ssl_flags', curlSslFlags);
          core.setOutput('token', finalToken);

    - name: Delete ArgoCD apps (per app)
      if: ${{ inputs.delete_first || inputs.delete_only }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');

          function httpCode(cmd) {
            return parseInt(execSync(`${cmd} -o /dev/null -w "%{http_code}"`).toString().trim(), 10);
          }

          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const appUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;
            core.info(`🗑️ Deleting ArgoCD Application: ${appName}`);

            const delCmd = `curl -s ${process.env.CURL_SSL_FLAGS} -X DELETE "${appUrl}" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" -H "Content-Type: application/json"`;
            const code = httpCode(delCmd);
            core.info(`Delete response HTTP ${code}`);

            if (![200, 202, 204].includes(code)) {
              core.setFailed(`❌ Failed to delete ${appName}: HTTP ${code}`);
              return;
            }

            const timeout = Date.now() + 120000;
            while (Date.now() < timeout) {
              const checkCmd = `curl -s ${process.env.CURL_SSL_FLAGS} -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${appUrl}"`;
              const checkCode = httpCode(checkCmd);
              if (checkCode === 403) {
                core.info(`✅ ${appName} deleted (HTTP 403)`);
                break;
              }
              core.info(`⏳ Still deleting ${appName} (HTTP ${checkCode})...`);
              await new Promise(r => setTimeout(r, 5000));
            }
          }

    - name: Clear apps from CD repo (delete_only mode)
      if: ${{ inputs.delete_only }}
      uses: actions/github-script@v7
      env:
        CD_PATH_REL: ${{ steps.cdroot.outputs.cd_root }}
        APPS: ${{ steps.apps.outputs.apps }}
      with:
        script: |
          const fs = require('fs');
          const path = require('path');
          const { execSync } = require('child_process');

          const apps = JSON.parse(process.env.APPS || '[]');
          const cdRootRel = process.env.CD_PATH_REL;

          for (const app of apps) {
            const appDir = path.join('continuous-deployment', cdRootRel, app.name);
            if (fs.existsSync(appDir)) {
              core.info(`🗑️ Removing app directory: ${appDir}`);
              execSync(`rm -rf "${appDir}"`);
            } else {
              core.info(`⚠️ Directory not found for app: ${app.name}`);
            }
          }

          core.setOutput('cd_path_rel', cdRootRel);

    - name: Commit and push deletions to temp branch
      id: commit_delete
      if: ${{ inputs.delete_only }}
      run: |
        set -euo pipefail
        cd continuous-deployment

        echo "🔎 Debug: Current working directory = $(pwd)"
        git remote -v

        git config user.name "k8s-deploy"
        git config user.email "actions@gitopsmanager.com"

        echo "Staging deletions in: ${{ steps.cdroot.outputs.cd_root }}/"
        git rm -r "${{ steps.cdroot.outputs.cd_root }}/" 2>/dev/null || true

        echo "🔎 Debug: Status after staging:"
        git status --short || true
        git diff --cached --stat || true

        if git diff --cached --quiet; then
          echo "⚠️ No deletions detected — creating empty commit"
          git commit --allow-empty -m "No-op delete commit for ${{ fromJSON(steps.apps.outputs.apps)[0].name }} at $(date -u)"
        else
          git commit -m "Delete apps in ${{ steps.env.outputs.cluster }}/${{ inputs.namespace }} for ${{ fromJSON(steps.apps.outputs.apps)[0].name }} (delete_only mode)"
        fi

        branch="delete-${{ steps.env.outputs.cluster }}-${{ inputs.namespace }}-${{ fromJSON(steps.apps.outputs.apps)[0].name }}-$(date +%s)"
        echo "🔎 Debug: Branch to push = $branch"

        git log -1 --oneline

        git push --verbose origin HEAD:"$branch" || { echo "❌ git push failed"; exit 1; }

        git ls-remote origin "refs/heads/$branch" || echo "⚠️ Branch not found on remote"

        echo "branch=$branch" >> "$GITHUB_OUTPUT"
      env:
        GIT_TOKEN: ${{ steps.generate_token.outputs.token }}


    - name: Create and squash-merge PR (delete-only)
      if: ${{ inputs.delete_only }}
      uses: actions/github-script@v7
      with:
        github-token: ${{ steps.generate_token.outputs.token }}
        script: |
          const owner = process.env.CD_REPO_ORG;
          const repo = process.env.CD_REPO;
          const branch = process.env.BRANCH;
          const appName = process.env.APP_NAME;

          // Detect default branch dynamically
          const { data: repoInfo } = await github.rest.repos.get({ owner, repo });
          const baseBranch = repoInfo.default_branch;
          core.info(`ℹ️ Default branch for ${owner}/${repo} = ${baseBranch}`);

          // Create PR
          const { data: pr } = await github.rest.pulls.create({
            owner,
            repo,
            head: branch,
            base: baseBranch,
            title: `Delete ${appName} in ${process.env.CLUSTER}/${process.env.NAMESPACE}`,
            body: "Automated delete-only deployment update."
          });
          core.info(`✅ Opened delete-only PR #${pr.number}`);

          // Poll until mergeable state is computed
          let mergeable = null;
          let mergeableState = null;
          for (let i = 0; i < 10; i++) {
            const { data: prStatus } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: pr.number
            });
            mergeable = prStatus.mergeable;
            mergeableState = prStatus.mergeable_state;
            core.info(`ℹ️ Attempt ${i+1}: mergeable=${mergeable}, state=${mergeableState}`);
            if (mergeable !== null) break;
            await new Promise(r => setTimeout(r, 2000));
          }

          if (mergeable === false) {
            core.setFailed(`❌ PR #${pr.number} is not mergeable (state=${mergeableState}).`);
          } else if (mergeable === null) {
            core.setFailed(`❌ PR #${pr.number} mergeability never resolved.`);
          } else {
            // 🔁 Retry loop for transient "base modified" errors
            const maxRetries = 10;
            let merged = false;
            for (let i = 0; i < maxRetries; i++) {
              try {
                await github.rest.pulls.merge({
                  owner,
                  repo,
                  pull_number: pr.number,
                  merge_method: "squash"
                });
                core.info(`✅ Squash-merged delete-only PR #${pr.number} on attempt ${i+1}`);
                merged = true;
                break;
              } catch (err) {
                if (err.message && err.message.includes("Base branch was modified")) {
                  core.warning(`⚠️ Attempt ${i+1}: base branch changed, retrying in 2s...`);
                  await new Promise(r => setTimeout(r, 2000));
                  continue;
                }
                throw err; // unexpected failure
              }
            }
            if (!merged) {
              core.setFailed(`❌ Could not squash-merge delete-only PR #${pr.number} after ${maxRetries} retries`);
            }
          }
      env:
        CD_REPO_ORG: ${{ inputs.cd_repo_org }}
        CD_REPO: ${{ inputs.cd_repo }}
        BRANCH: ${{ steps.commit_delete.outputs.branch }}
        CLUSTER: ${{ steps.env.outputs.cluster }}
        NAMESPACE: ${{ inputs.namespace }}
        APP_NAME: ${{ fromJSON(steps.apps.outputs.apps)[0].name }}




    - name: Check or create ArgoCD applications (per app)
      uses: actions/github-script@v7
      if: ${{ inputs.delete_only == false }}
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        CD_PATH_REL: ${{ steps.copy.outputs.cd_path_rel }}
        OVERLAY_DIR: ${{ inputs.overlay_dir }}
        CD_REPO: ${{ inputs.cd_repo }}
        CD_REPO_ORG: ${{ inputs.cd_repo_org }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const fs = require('fs');
          const path = require('path');
          const nunjucks = require('./nunjucks.js');
          const apps = JSON.parse(process.env.APPS || '[]');

          function curlJson(url) {
            return execSync(`curl -s ${process.env.CURL_SSL_FLAGS} -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${url}"`).toString();
          }

          function deleteApp(appUrl, appName) {
            execSync(`curl -s -o /dev/null -w "%{http_code}" ${process.env.CURL_SSL_FLAGS} -X DELETE "${appUrl}" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" -H "Content-Type: application/json"`);
            const timeout = Date.now() + 120000;
            while (Date.now() < timeout) {
              const code = parseInt(execSync(`curl -s -o /dev/null -w "%{http_code}" ${process.env.CURL_SSL_FLAGS} -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${appUrl}"`).toString());
              if (code === 403) return true;
              new Promise(r => setTimeout(r, 5000));
            }
            return false;
          }

          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const statusUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;
            const basePath = path.join(process.env.CD_PATH_REL, app.name, 'overlays', process.env.OVERLAY_DIR);

            const status = curlJson(statusUrl);
            if (status) {
              try {
                const existing = JSON.parse(status);
                if (existing?.spec?.source?.path !== basePath) {
                  core.warning(`⚠️ Path mismatch for ${appName}, recreating`);
                  deleteApp(statusUrl, appName);
                } else {
                  core.info(`✅ Argo app ${appName} exists with correct path.`);
                  continue;
                }
              } catch {
                // treat as non-200
              }
            }

            const template = fs.readFileSync('reusable/templates/argocd-app-template-v6.json', 'utf8');
            const rendered = nunjucks.renderString(template, {
              APP_NAME: appName,
              NAMESPACE: process.env.NAMESPACE,
              CD_REPO: process.env.CD_REPO,
              CD_REPO_ORG: process.env.CD_REPO_ORG,
              CD_PATH: basePath
            });

            execSync(`curl -s ${process.env.CURL_SSL_FLAGS} -X POST "${process.env.ARGOCD_URL}/api/v1/applications" -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" -H "Content-Type: application/json" -d '${rendered.replace(/'/g,"'\\''")}'`);
            core.info(`✅ Created Argo app ${appName}`);
          }


    - name: Sync ArgoCD apps (per app)
      id: sync
      if: ${{ inputs.delete_only == false }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          const baselines = {};

          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const statusUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;

            let baseline = 0;
            try {
              const status = execSync(`curl -s ${process.env.CURL_SSL_FLAGS} -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${statusUrl}"`).toString();
              const json = JSON.parse(status);
              if (json?.status?.operationState?.startedAt) {
                baseline = new Date(json.status.operationState.startedAt).getTime();
              }
            } catch {}
            baselines[appName] = baseline;

            // 🧨 Force prune sync
            execSync(`curl -s ${process.env.CURL_SSL_FLAGS} -X POST "${statusUrl}/sync" \
              -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" \
              -H "Content-Type: application/json" \
              -d '{"prune": true, "force": true}'`);

            core.info(`🚀 Force-prune sync triggered: ${appName}`);
          }

          core.setOutput('baselines', JSON.stringify(baselines));


    - name: Wait for ArgoCD sync (per app)
      if: ${{ inputs.skip_status_check == false && inputs.delete_only == false }}
      uses: actions/github-script@v7
      env:
        APPS: ${{ steps.apps.outputs.apps }}
        ARGOCD_URL: ${{ steps.argocd_conn.outputs.argocd_url }}
        ARGOCD_TOKEN: ${{ steps.argocd_conn.outputs.token }}
        CURL_SSL_FLAGS: ${{ steps.argocd_conn.outputs.curl_ssl_flags }}
        NAMESPACE: ${{ inputs.namespace }}
        BASELINES: ${{ steps.sync.outputs.baselines }}
      with:
        script: |
          const { execSync } = require('child_process');
          const apps = JSON.parse(process.env.APPS || '[]');
          const baselines = JSON.parse(process.env.BASELINES || '{}');

          // Helper: determine if all resources are synced
          function allResourcesSynced(json) {
            const results =
              json?.status?.operationState?.syncResult?.resources ||
              json?.status?.operationState?.results ||
              [];
            return (
              Array.isArray(results) &&
              results.length > 0 &&
              results.every(r => r.status === 'Synced' || r.hookPhase === 'Succeeded')
            );
          }

          for (const app of apps) {
            const appName = `${process.env.NAMESPACE}-${app.name}`;
            const statusUrl = `${process.env.ARGOCD_URL}/api/v1/applications/${appName}`;
            const baseline = baselines[appName] || 0;
            core.startGroup(`⏳ Waiting for sync of ${appName}, baseline=${baseline}`);

            let ok = false;
            let lastPhase, lastSync, lastHealth;
            let consecutiveErrors = 0;

            for (let i = 0; i < 36; i++) {
              try {
                const status = execSync(
                  `curl -s ${process.env.CURL_SSL_FLAGS} -H "Authorization: Bearer ${process.env.ARGOCD_TOKEN}" "${statusUrl}"`
                ).toString();
                const json = JSON.parse(status);

                const op = json?.status?.operationState;
                lastPhase = op?.phase;
                lastSync = json?.status?.sync?.status;
                lastHealth = json?.status?.health?.status;

                core.info(
                  `🔄 Iteration ${i + 1}/36 for ${appName}: phase=${lastPhase}, sync=${lastSync}, health=${lastHealth}`
                );

                consecutiveErrors = 0; // reset error counter if fetch succeeded

                // Immediate fail conditions
                if (lastPhase === 'Error' || lastSync === 'Error' || lastSync === 'Failed') {
                  core.setFailed(`❌ Sync failed for ${appName} (phase=${lastPhase}, sync=${lastSync})`);
                  return;
                }

                const startedAt = op?.startedAt ? new Date(op.startedAt).getTime() : 0;
                const allSynced = allResourcesSynced(json);

                // Case 1: new operation started after baseline
                if (startedAt > baseline) {
                  if (lastHealth === 'Degraded') {
                    core.setFailed(`❌ ${appName} is Synced but health=Degraded.`);
                    return;
                  }

                  // Standard success condition
                  if (lastPhase === 'Succeeded' && lastSync === 'Synced' && lastHealth === 'Healthy') {
                    core.info(`✅ ${appName} synced after baseline and is Healthy.`);
                    ok = true;
                    break;
                  }

                  // New condition: All resources synced, app healthy
                  else if (allSynced && lastHealth === 'Healthy') {
                    core.info(`✅ ${appName} has all synced results and is Healthy.`);
                    ok = true;
                    break;
                  }

                  // Waiting state
                  else if (lastSync === 'Synced') {
                    core.info(`⏳ ${appName} is Synced but health=${lastHealth} → waiting for Healthy...`);
                  }
                }

                // Case 2: no new operation, but app is already good
                if (startedAt <= baseline) {
                  if (lastSync === 'Synced' && lastHealth === 'Healthy') {
                    core.info(`✅ ${appName} was already Synced and Healthy before baseline.`);
                    ok = true;
                    break;
                  }
                }
              } catch (err) {
                consecutiveErrors++;
                if (consecutiveErrors > 3) {
                  core.setFailed(
                    `❌ Failed to fetch status for ${appName} after ${consecutiveErrors} attempts: ${err.message}`
                  );
                  return;
                } else {
                  core.warning(
                    `⚠️ Failed to fetch status for ${appName} (attempt ${consecutiveErrors}): ${err.message}`
                  );
                }
              }

              await new Promise((r) => setTimeout(r, 10000));
            }

            if (!ok) {
              core.setFailed(
                `❌ Sync did not complete in time for ${appName} (last phase=${lastPhase}, sync=${lastSync}, health=${lastHealth})`
              );
            }

            core.endGroup();
          }