name: cleanup-expired

on:
  schedule:
    - cron: "17 * * * *"
  workflow_dispatch:

jobs:
  cleanup-expired:
    runs-on:
      - toolzoo-host
    env:
      AWS_REGION: us-east-1
      APP_STACK_PREFIX: temp-stack
      TTL_GRACE_SECONDS: "600"
    steps:
      - name: Cleanup expired app stacks
        shell: bash
        run: |
          set -euo pipefail
          repo_full="${GITHUB_REPOSITORY:-}"
          current_repo_raw="${repo_full##*/}"
          catalog_updated="0"
          now_epoch="$(date -u +%s)"
          prefix="${APP_STACK_PREFIX}-"
          stacks="$(aws cloudformation list-stacks \
            --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE UPDATE_ROLLBACK_COMPLETE \
            --query "StackSummaries[?starts_with(StackName, \`${prefix}\`)].StackName" \
            --output text)"

          for stack in $stacks; do
            expires_at="$(aws cloudformation describe-stacks --stack-name "$stack" --query "Stacks[0].Tags[?Key=='ExpiresAt'].Value | [0]" --output text)"
            owner_raw="$(aws cloudformation describe-stacks --stack-name "$stack" --query "Stacks[0].Tags[?Key=='Owner'].Value | [0]" --output text)"
            repo_raw="$(aws cloudformation describe-stacks --stack-name "$stack" --query "Stacks[0].Tags[?Key=='Repository'].Value | [0]" --output text)"

            if [[ "$expires_at" == "None" || -z "$expires_at" ]]; then
              continue
            fi

            expires_epoch="$(date -u -d "$expires_at" +%s 2>/dev/null || echo 0)"
            if [[ "$expires_epoch" -eq 0 ]]; then
              continue
            fi

            if (( now_epoch >= expires_epoch + TTL_GRACE_SECONDS )); then
              aws cloudformation delete-stack --stack-name "$stack"
              aws cloudformation wait stack-delete-complete --stack-name "$stack"

              if [[ "$owner_raw" != "None" && "$repo_raw" != "None" && -n "$owner_raw" && -n "$repo_raw" ]]; then
                repo_slug="$(printf '%s' "$repo_raw" | tr '[:upper:]' '[:lower:]')"
                ecr_repo="temp/${repo_slug}"
                if aws ecr describe-repositories --repository-names "$ecr_repo" >/dev/null 2>&1; then
                  aws ecr delete-repository --repository-name "$ecr_repo" --force
                fi
              fi

              if [[ "$repo_raw" == "$current_repo_raw" && -f catalog-info.yaml ]]; then
                awk '
                  BEGIN { in_block=0 }
                  /^    # BEGIN TOOLZOO MANAGED LINK$/ { in_block=1; next }
                  /^    # END TOOLZOO MANAGED LINK$/ { in_block=0; next }
                  in_block==1 { next }
                  { print }
                ' catalog-info.yaml > /tmp/catalog-info.yaml.cleaned

                if ! cmp -s catalog-info.yaml /tmp/catalog-info.yaml.cleaned; then
                  mv /tmp/catalog-info.yaml.cleaned catalog-info.yaml
                  catalog_updated="1"
                else
                  rm -f /tmp/catalog-info.yaml.cleaned
                fi
              fi
            fi
          done

          if [[ "$catalog_updated" == "1" ]]; then
            git config user.name "toolzoo-bot"
            git config user.email "toolzoo-bot@local"
            git add catalog-info.yaml
            git commit -m "Remove stale service URL after cleanup"
            git push origin HEAD:main
          fi