name: Dry run Snowflake changes

on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'permifrost.yml' # Only run if permifrost.yml config is modified

permissions:
  contents: read
  statuses: write
  pull-requests: write

jobs:
  tundri:
    name: tundri setup and dry run
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: '3.10'

      - name: Install tundri
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Setup Snowflake Private Key
        run: |
          # encoded with command: base64 -w 0 key.p8 > encoded_key.txt
          echo "${{ secrets.PERMISSION_BOT_PRIVATE_KEY_ENCODED_BASE64 }}" | base64 --decode > $HOME/snowflake_permifrost.p8
          chmod 600 $HOME/snowflake_permifrost.p8
          echo "PERMISSION_BOT_KEY_PATH=$HOME/snowflake_permifrost.p8" >> $GITHUB_ENV

      - name: Dry run tundri
        id: dry_run
        env:
          PERMISSION_BOT_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
          PERMISSION_BOT_DATABASE: PERMIFROST
          PERMISSION_BOT_USER: PERMIFROST
          PERMISSION_BOT_ROLE: SECURITYADMIN
          PERMISSION_BOT_WAREHOUSE: ADMIN
          PERMISSION_BOT_KEY_PASSPHRASE: ${{ secrets.PERMISSION_BOT_KEY_PASSPHRASE }}
        run: |
          set -o pipefail
          tundri run --filepath permifrost.yml --dry 2>&1 | tee tundri_output.txt

      - name: Check for DROP statements
        if: always() && steps.dry_run.outcome != 'skipped'
        id: drop_check
        run: |
          # Tundri output format: "            - DROP database foo_bar    core.py:96"
          # Extract DROP statements, stripping leading whitespace/bullet and trailing source references
          if grep -iP '^\s*-?\s*DROP\s' tundri_output.txt | sed 's/^\s*-\?\s*//; s/\s\+\S*\.py:[0-9]\+\s*$//' > drop_statements.txt 2>/dev/null && [ -s drop_statements.txt ]; then
            echo "found=true" >> "$GITHUB_OUTPUT"
            echo "### DROP statements detected:"
            cat drop_statements.txt
          else
            echo "found=false" >> "$GITHUB_OUTPUT"
            echo "No DROP statements detected."
          fi

      - name: Set drop-statement-review status
        if: always() && github.event_name == 'pull_request' && steps.drop_check.outcome != 'skipped'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [ "${{ steps.drop_check.outputs.found }}" = "true" ]; then
            STATE="failure"
            DESCRIPTION="DROP statements require approval"
          else
            STATE="success"
            DESCRIPTION="No DROP statements detected"
          fi

          gh api "repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" \
            -f state="$STATE" \
            -f description="$DESCRIPTION" \
            -f context="drop-statement-review"

      - name: Comment on PR with DROP statements
        if: always() && github.event_name == 'pull_request' && steps.drop_check.outputs.found == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          DROP_SQL=$(cat drop_statements.txt)

          BODY="⚠️ **DROP statements detected in dry run**

          The following DROP statements will be executed when this PR is merged:

          \`\`\`sql
          ${DROP_SQL}
          \`\`\`

          If these drops are intentional, comment \`/proceed-with-drop-statements\` to approve."

          gh pr comment "${{ github.event.pull_request.number }}" --body "$BODY"