name: Terraform Plan

on:
  pull_request:
    branches: [main]
    paths:
      - 'sites/**'
      - 'modules/**'
      - 'backend.hcl'
      - '.github/workflows/**'

jobs:
  detect-sites:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.detect.outputs.matrix }}
      has-changes: ${{ steps.detect.outputs.has-changes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: detect
        run: |
          all_sites=$(find sites -maxdepth 1 -mindepth 1 -type d -exec basename {} \; | sort | jq -sRc '.')
          if git diff origin/main...HEAD --name-only | grep -qE '^(modules/|backend\.hcl)'; then
            echo "has-changes=true" >> $GITHUB_OUTPUT
            echo "matrix={\"site\": $all_sites}" >> $GITHUB_OUTPUT
          else
            changed=$(git diff origin/main...HEAD --name-only | grep '^sites/' | cut -d/ -f2 | sort -u | jq -sRc '.')
            if [ "$changed" = "[]" ] || [ -z "$changed" ]; then
              echo "has-changes=false" >> $GITHUB_OUTPUT
              echo "matrix={\"site\": []}" >> $GITHUB_OUTPUT
            else
              echo "has-changes=true" >> $GITHUB_OUTPUT
              echo "matrix={\"site\": $changed}" >> $GITHUB_OUTPUT
            fi
          fi

  plan:
    needs: detect-sites
    if: needs.detect-sites.outputs.has-changes == 'true'
    strategy:
      matrix: ${{ fromJSON(needs.detect-sites.outputs.matrix) }}
      fail-fast: false
    name: Terraform Plan - ${{ matrix.site }}
    runs-on: self-hosted
    permissions:
      pull-requests: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure git SSH
        run: git config --global url."git@github.mpi-internal.com:".insteadOf "https://github.mpi-internal.com/"

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.0

      - name: Terraform Init
        working-directory: sites/${{ matrix.site }}
        run: |
          terraform init \
            -backend-config=../../backend.hcl \
            -backend-config="key=${{ matrix.site }}/terraform.tfstate"
        env:
          AWS_ACCESS_KEY_ID:        ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:    ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION:               us-east-1
          MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }}

      - name: Terraform Plan
        id: plan
        working-directory: sites/${{ matrix.site }}
        run: terraform plan -no-color 2>&1 | tee plan_output.txt
        env:
          AWS_ACCESS_KEY_ID:        ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:    ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION:               us-east-1
          MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
          TF_VAR_radius_secret:     ${{ secrets.RADIUS_SECRET }}
          TF_VAR_wifi_password_psk: ${{ secrets.WIFI_PASSWORD_PSK }}

      - name: Comentar Plan en el PR
        uses: actions/github-script@v7
        if: always()
        with:
          script: |
            const fs = require('fs');
            const plan = fs.readFileSync('sites/${{ matrix.site }}/plan_output.txt', 'utf8');
            const truncated = plan.length > 60000 ? plan.substring(0, 60000) + '\n...(truncado)' : plan;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## Terraform Plan - ${{ matrix.site }}\n\`\`\`\n${truncated}\n\`\`\``
            });