name: 全局K3s部署
on:
  push:
    branches: [master]

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      # 从组织级Secrets读取，不用在仓库重复配置
      K3S_HOST: ${{ secrets.K3S_HOST }}
      APP_NAME: ${{ gitea.repo_name }}
    steps:
      - name: 拉取代码
        uses: actions/checkout@v4

      - name: SSH部署K3s
        run: |
          mkdir -p ~/.ssh
          # 写入组织配置的SSH私钥
          echo "${{ secrets.K3S_SSH_KEY }}" > k3s.pem
          chmod 600 k3s.pem
          # 调试：验证私钥是否正确写入
          echo "私钥文件权限："
          ls -l k3s.pem
          echo "私钥头部（仅前5行）："
          head -5 k3s.pem
          # 测试连接（会输出服务器主机名和kubectl版本）
          ssh -i k3s.pem -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@${K3S_HOST} "hostname && kubectl version --client"
          # 正式执行部署命令
          ssh -i k3s.pem -o StrictHostKeyChecking=no root@${K3S_HOST} << CMD
            kubectl apply -f /k8s/deploy.yaml
            kubectl rollout restart deployment ${APP_NAME}
          CMD