# pulumi-preview — read-only infra drift / PR check (T14, state-dependent half).
#
# Runs on the foundation's OWN runner in the baked foundation-ci image. Unlike
# ci.yml (self-contained), this needs Pulumi STATE, which bootstrap/state/ is
# gitignored from. It pulls the latest `pulumi stack export` that run.sh publishes
# to rfs/foundation-ci-state/foundation-stack.json on every `up` (state-publish.sh),
# imports it into a throwaway file backend, and previews. CONFIG + encrypted
# secrets come from the committed Pulumi.foundation.yaml (the passphrase decrypts).
#
# READ-ONLY: `pulumi preview` only — NEVER `up`. It dials the VM docker over SSH
# the same way the operator does (ADR-007), so the operator key is materialized
# from the SSH_PRIVATE_KEY secret. A diff is informational (expected on infra PRs),
# so the job does NOT fail on changes — it fails only if the program/preview errors.
#
# Secrets (repo-scoped, set via the admin API): PULUMI_CONFIG_PASSPHRASE,
# SSH_PRIVATE_KEY (operator ed25519), RUSTFS_ACCESS_KEY/RUSTFS_SECRET_KEY (scoped
# RustFS service account, to fetch the state object over foundation-net).
name: pulumi-preview
on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  preview:
    runs-on: docker
    container:
      image: foundation-ci:latest
    env:
      PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
      SSH_PRIVATE_KEY_PATH: /tmp/op_key
      PULUMI_SKIP_UPDATE_CHECK: "true"
    steps:
      - uses: actions/checkout@v4

      - name: Install workspace deps (bun workspace, root lockfile)
        run: bun install --frozen-lockfile || bun install

      - name: Materialize operator SSH key (provider + index.ts read it)
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          install -m 600 /dev/null /tmp/op_key
          printf '%s' "$SSH_PRIVATE_KEY" > /tmp/op_key
          # OpenSSH keys must end in a newline; add one only if missing.
          [ -z "$(tail -c1 /tmp/op_key)" ] || printf '\n' >> /tmp/op_key
          ssh-keygen -y -f /tmp/op_key > /tmp/op_key.pub

      - name: Fetch Pulumi state from RustFS
        env:
          RUSTFS_ACCESS_KEY: ${{ secrets.RUSTFS_ACCESS_KEY }}
          RUSTFS_SECRET_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
        run: |
          mc alias set rfs http://foundation-rustfs:9000 "$RUSTFS_ACCESS_KEY" "$RUSTFS_SECRET_KEY" >/dev/null
          mc cp rfs/foundation-ci-state/foundation-stack.json /tmp/foundation-stack.json

      - name: Pulumi preview (read-only — never up)
        working-directory: bootstrap
        run: |
          mkdir -p state   # bootstrap/state/ is gitignored — create the file backend dir
          export PULUMI_BACKEND_URL="file://$(pwd)/state"
          pulumi stack select foundation 2>/dev/null || pulumi stack init foundation
          pulumi stack import --file /tmp/foundation-stack.json
          pulumi preview --non-interactive --diff