# platform/fleet/.gitlab-ci.yml — the only pipeline that touches a cluster
workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "pipeline"'   # an app pipeline fired it
    - if: '$CI_PIPELINE_SOURCE == "web"'        # or someone pressed Run
    - when: never

rollout:
  stage: rollout
  image: bitnami/kubectl:1.31
  resource_group: $CLUSTER/$APP/$RING   # one rollout at a time per target
  script:
    - |
      set -euo pipefail
      # one file-type variable per cluster: KUBECONFIG_NORTH, ...
      eval "export KUBECONFIG=\$KUBECONFIG_$(echo "$CLUSTER" | tr a-z A-Z)"
      NS="$APP-$RING"                       # namespaces follow one convention
      DIR="$CLUSTER/$APP/$RING"

      kubectl -n "$NS" apply -f "$CLUSTER/$APP/common/$RING/"
      kubectl -n "$NS" apply -f "$DIR/"

      echo "$ROLLOUT_SET" \
        | jq -c '.[] | select(.image | test("@sha256"))' \
        | while read -r entry; do
            unit=$(jq -r .unit <<<"$entry")
            container=$(jq -r .container <<<"$entry")
            image=$(jq -r .image <<<"$entry")
            kubectl -n "$NS" set image deployment \
              -l "app=$APP,unit=$unit" "$container=$image"
          done

      for d in $(kubectl -n "$NS" get deploy -l "app=$APP" -o name); do
        kubectl -n "$NS" rollout status "$d" --timeout=10m || {
          kubectl -n "$NS" describe "$d"
          kubectl -n "$NS" logs "$d" --all-containers --tail=100 || true
          exit 1
        }
      done