# =============================================================================
# Deploy Prometheus Alert Rules (獨立 workflow)
# 2026-04-05 Claude Code (ADR-039 I3): 從 cd.yaml 分離
# 觸發條件: ops/monitoring/alerts-unified.yml / slo-rules.yml 有變更 或 workflow_dispatch
# 說明: 告警規則部署不依賴應用構建，獨立觸發以加快響應速度
# =============================================================================

name: Deploy Alert Rules

on:
  # 2026-06-28 Codex: 110 runner 壓力事故期間，告警規則部署改為受控手動觸發。
  # push path filtering 不得在 runner 搬遷 / 硬限流前重開。
  workflow_dispatch:

jobs:
  deploy-alerts:
    name: "Deploy Prometheus Alert Rules"
    runs-on: awoooi-non110-ubuntu
    timeout-minutes: 5
    steps:
      - name: Checkout source from Gitea
        env:
          GITEA_SOURCE_URL: http://192.168.0.110:3001/wooo/awoooi.git
        run: |
          set -euo pipefail
          git init .
          git remote remove origin 2>/dev/null || true
          git remote add origin "$GITEA_SOURCE_URL"
          git fetch --no-tags --prune --depth=1 origin "$GITHUB_SHA"
          git checkout --force --detach FETCH_HEAD

      - name: Validate alerts YAML
        # 2026-04-08 Claude Sonnet 4.6: pip install pyyaml 確保 runner 有此依賴
        run: |
          pip3 install -q pyyaml 2>/dev/null || pip install -q pyyaml
          python3 -c "import yaml; yaml.safe_load(open('ops/monitoring/alerts-unified.yml')); print('YAML OK')"
          python3 -c "import yaml; yaml.safe_load(open('ops/monitoring/slo-rules.yml')); print('SLO YAML OK')"

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          umask 077
          source_key="${AWOOOI_DEPLOY_SSH_KEY_PATH:-${HOME}/.ssh/deploy_key}"
          if [ ! -r "${source_key}" ]; then
            echo "deploy ssh key file missing: ${source_key}" >&2
            exit 1
          fi
          cp "${source_key}" ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan 192.168.0.110 >> ~/.ssh/known_hosts

      - name: Deploy alerts to Prometheus
        run: bash scripts/ops/deploy-alerts.sh

      - name: Notify deploy result
        if: always()
        env:
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
        run: |
          STATUS="${{ job.status }}"
          EMOJI="✅"
          [ "$STATUS" != "success" ] && EMOJI="❌"
          SHORT_SHA="${{ github.sha }}"
          SHORT_SHA="${SHORT_SHA:0:7}"
          MSG="${EMOJI} Prometheus 告警規則部署 ${STATUS} (${SHORT_SHA})"
          CICD_STATUS="success"
          [ "$STATUS" != "success" ] && CICD_STATUS="failed"
          if AWOOI_CICD_STATUS="${CICD_STATUS}" \
            AWOOI_CICD_STAGE=deploy-alerts \
            AWOOI_CICD_JOB_NAME="Prometheus 告警規則部署" \
            AWOOI_CICD_COMMIT_SHA="${{ github.sha }}" \
            AWOOI_CICD_SUMMARY="${MSG}" \
            scripts/ci/notify-awoooi-cicd.sh; then
            echo "Alert rule deploy notification mirrored through AWOOI API"
          else
            echo "AWOOI API notify failed; direct Telegram fallback disabled to preserve AwoooP receipt chain"
          fi