# Example: schedule neo4j-backup on GitHub Actions.
#
# This is a TEMPLATE — copy it to `.github/workflows/` in your deployment repo (it is not wired
# into this project's CI). See docs/CI.md for the full write-up and caveats.
#
# Execution model: run on a SELF-HOSTED runner that is your backup runner (DESIGN.md's central
# runner). It needs neo4j-admin on PATH, network to the database backup port (6362), object-store
# egress, and a scratch disk sized for the largest full backup. GitHub-hosted runners (≈14 GB disk,
# 6 h cap, no neo4j-admin) suit only tiny/demo databases — real fleets use self-hosted.

name: neo4j-backup

on:
  schedule:
    - cron: "17 2 * * *"    # daily differential  (GitHub cron is best-effort; drift/skips happen)
    - cron: "17 3 * * 0"    # weekly full + maintenance
  workflow_dispatch:
    inputs:
      kind:
        description: "backup kind (AUTO|FULL|DIFF)"
        default: "AUTO"

# One lane per group: never overlap two backups of the same group. Mirror the orchestrators'
# concurrency pools (DESIGN.md §5.5) with one workflow (or one group=…) per lane.
concurrency:
  group: neo4j-backup-demo
  cancel-in-progress: false

env:
  # --- non-secret config (repo/org Variables) ---
  NEO4J_BOLT_URI: ${{ vars.NEO4J_BOLT_URI }}          # neo4j://db-host:7687
  NEO4J_BACKUP_SOURCE: ${{ vars.NEO4J_BACKUP_SOURCE }} # db-host:6362 (backup port)
  BACKUP_BUCKET: ${{ vars.BACKUP_BUCKET }}
  CLOUD: ${{ vars.CLOUD }}                             # aws (default) | azure | gcp
  AWS_REGION: ${{ vars.AWS_REGION }}
  NEO4J_BACKUP_POLICY: policies/demo.yaml             # in the repo, or s3://… (#43)
  RUNNER_PAGECACHE: "512M"                             # MUST be explicit or neo4j-admin OOMs
  SCRATCH_PATH: ${{ runner.temp }}/neo4j-scratch      # size for the largest full backup
  # --- secrets ---
  NEO4J_PASSWORD: ${{ secrets.NEO4J_PASSWORD }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  backup:
    runs-on: [self-hosted, neo4j-backup]
    steps:
      - uses: actions/checkout@v4              # for the policy file
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install neo4j-backup
        # Not on PyPI — install from a pinned tag (or vendor the source and `pip install ./orchestrator`).
        run: pip install "neo4j-backup-dagster @ git+https://github.com/lex00/neo4j-backup@v0.4.0#subdirectory=orchestrator"
      - name: Back up
        run: |
          # weekly-full schedule -> FULL, daily schedule -> DIFF, manual -> the chosen kind
          kind="${{ github.event.inputs.kind || (github.event.schedule == '17 3 * * 0' && 'FULL' || 'DIFF') }}"
          neo4j-backup --json backup demo --kind "$kind"   # non-zero exit fails the job

  # Weekly consistency check + retention. Runs only on the weekly schedule; --confirm is set because
  # the schedule *is* the human approval for the guarded (destructive) prune.
  maintain:
    if: github.event.schedule == '17 3 * * 0'
    needs: backup
    runs-on: [self-hosted, neo4j-backup]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install "neo4j-backup-dagster @ git+https://github.com/lex00/neo4j-backup@v0.4.0#subdirectory=orchestrator"
      - run: neo4j-backup --json verify demo
      - run: neo4j-backup --json prune --confirm