name: Terraform Apply

on:
  push:
    branches: [main]
    paths:
      - 'sites/**'
      - 'modules/**'
      - 'backend.hcl'

jobs:
  detect-sites:
    runs-on: self-hosted
    outputs:
      matrix: ${{ steps.detect.outputs.matrix }}
      has-changes: ${{ steps.detect.outputs.has-changes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - id: detect
        run: |
          all_sites=$(find sites -maxdepth 1 -mindepth 1 -type d -exec basename {} \; | sort | jq -Rc 'select(. != "")' | jq -sc '.')
          if git diff HEAD~1...HEAD --name-only | grep -qE '^(modules/|backend\.hcl)'; then
            echo "has-changes=true" >> $GITHUB_OUTPUT
            echo "matrix={\"site\": $all_sites}" >> $GITHUB_OUTPUT
          else
            changed=$(git diff HEAD~1...HEAD --name-only | grep '^sites/' | cut -d/ -f2 | sort -u | jq -Rc 'select(. != "")' | jq -sc '.')
            if [ "$changed" = "[]" ] || [ -z "$changed" ]; then
              echo "has-changes=false" >> $GITHUB_OUTPUT
              echo "matrix={\"site\": []}" >> $GITHUB_OUTPUT
            else
              echo "has-changes=true" >> $GITHUB_OUTPUT
              echo "matrix={\"site\": $changed}" >> $GITHUB_OUTPUT
            fi
          fi

  apply:
    needs: detect-sites
    if: needs.detect-sites.outputs.has-changes == 'true'
    strategy:
      matrix: ${{ fromJSON(needs.detect-sites.outputs.matrix) }}
      max-parallel: 1   # serializar applies para evitar conflictos de estado en DynamoDB
      fail-fast: false
    name: Terraform Apply - ${{ matrix.site }}
    runs-on: self-hosted

    steps:
      - name: Reset git SSH override
        run: git config --global --unset url."git@github.mpi-internal.com:".insteadOf || true

      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure git SSH
        run: git config --global url."git@github.mpi-internal.com:".insteadOf "https://github.mpi-internal.com/"

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.0

      - name: Terraform Init
        working-directory: sites/${{ matrix.site }}
        run: |
          terraform init \
            -backend-config=../../backend.hcl \
            -backend-config="key=${{ matrix.site }}/terraform.tfstate"
        env:
          AWS_ACCESS_KEY_ID:        ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:    ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION:               us-east-1

      - name: Terraform Apply
        working-directory: sites/${{ matrix.site }}
        run: terraform apply -auto-approve
        env:
          AWS_ACCESS_KEY_ID:        ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY:    ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION:               us-east-1
          MERAKI_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
          TF_VAR_radius_secret:     ${{ secrets.RADIUS_SECRET }}
          TF_VAR_wifi_password_psk: ${{ secrets.WIFI_PASSWORD_PSK }}