name: gcp-readiness

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

concurrency:
  group: gcp-readiness-${{ github.ref }}
  cancel-in-progress: true

env:
  PROJECT_ID: teleo-501523
  WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github
  ARTIFACT_SERVICE_ACCOUNT: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com

jobs:
  readiness:
    name: Read-only GCP readiness probe
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.ARTIFACT_SERVICE_ACCOUNT }}

      - uses: google-github-actions/setup-gcloud@v2

      - name: Capture gcloud identity
        shell: bash
        run: |
          set +e
          mkdir -p .gcp-readiness
          {
            echo "project=${PROJECT_ID}"
            echo "service_account=${ARTIFACT_SERVICE_ACCOUNT}"
            echo "workflow_ref=${GITHUB_REF}"
            echo "revision=${GITHUB_SHA}"
          } > .gcp-readiness/context.txt
          gcloud auth list --format=json > .gcp-readiness/gcloud-auth-list.json 2> .gcp-readiness/gcloud-auth-list.stderr
          echo "$?" > .gcp-readiness/gcloud-auth-list.exitcode
          gcloud config list --format=json > .gcp-readiness/gcloud-config-list.json 2> .gcp-readiness/gcloud-config-list.stderr
          echo "$?" > .gcp-readiness/gcloud-config-list.exitcode

      - name: Run readiness checker
        shell: bash
        run: |
          set +e
          python3 ops/check_gcp_infra_readiness.py \
            > .gcp-readiness/gcp-infra-readiness.json \
            2> .gcp-readiness/gcp-infra-readiness.stderr
          echo "$?" > .gcp-readiness/gcp-infra-readiness.exitcode
          python3 - <<'PY'
          import json
          from pathlib import Path

          base = Path(".gcp-readiness")
          report = {
              "artifact": "github_wif_gcp_readiness_probe",
              "checker_exitcode": (base / "gcp-infra-readiness.exitcode").read_text().strip(),
              "stderr_tail": (base / "gcp-infra-readiness.stderr").read_text()[-2000:],
          }
          try:
              payload = json.loads((base / "gcp-infra-readiness.json").read_text() or "{}")
          except json.JSONDecodeError as exc:
              report["json_parse_error"] = str(exc)
              payload = {}
          if payload:
              report["pass_count"] = payload.get("pass_count")
              report["blocked_count"] = payload.get("blocked_count")
              report["fail_count"] = payload.get("fail_count")
              report["checks"] = [
                  {
                      "name": check.get("name"),
                      "status": check.get("status"),
                      "required_tier": check.get("required_tier"),
                      "current_tier": check.get("current_tier"),
                      "detail": (check.get("detail") or "")[:500],
                  }
                  for check in payload.get("checks", [])
              ]
          (base / "gcp-readiness-summary.json").write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
          print(json.dumps(report, indent=2, sort_keys=True))
          PY

      - name: Upload readiness artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gcp-readiness
          path: .gcp-readiness/
          if-no-files-found: error