- name: ssh-test
  image: google/cloud-sdk:latest
  entrypoint:
    - bash
    - -c
    - |
      set -euo pipefail

      mkdir -p ~/.ssh

      # ── Inject known-hosts and SSH key ───────────────────────────────
      gcloud secrets versions access latest \
        --secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
        | base64 -d > ~/.ssh/known_hosts
      chmod 644 ~/.ssh/known_hosts

      gcloud secrets versions access latest \
        --secret=STAGING_SSH_KEY --project=aptivaai-dev \
        | base64 -d > ~/.ssh/id_ed25519
      chmod 600 ~/.ssh/id_ed25519

      echo "🔑 SSH prerequisites installed"

      # ── Fetch IMG_TAG from canonical source ───────────────────────────
      IMG_TAG=$(gcloud secrets versions access latest \
        --secret=IMG_TAG --project=aptivaai-dev)
      echo "📦 IMG_TAG=${IMG_TAG}"

      # ── SSH into staging and refresh the stack ───────────────────────
      ssh -o StrictHostKeyChecking=yes \
          -i ~/.ssh/id_ed25519 \
          jcoakley@10.128.0.12 \
          "export IMG_TAG=${IMG_TAG}; \
           cd /home/jcoakley/aptiva-staging-app; \
           echo 'IMG_TAG = ${IMG_TAG}'; \
           echo '→ Pulling containers'; \
           docker compose pull; \
           echo '→ Recreating services'; \
           docker compose up -d --force-recreate --remove-orphans; \
           echo '✅ Staging stack refreshed with tag ${IMG_TAG}'"

secrets: [ gcp-creds ]
when:
  event:
    - push