name: Deploy

on:
  workflow_run:
    workflows:
      - CI
    types:
      - completed
  workflow_dispatch:

concurrency:
  group: deploy-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.ref }}
  cancel-in-progress: true

jobs:
  deploy:
    if: >
      github.event_name == 'workflow_dispatch' ||
      (
        github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'main'
      )
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}

      - name: Configure SSH key
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

      - name: Configure known hosts
        run: |
          printf '%s\n' "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          chmod 644 ~/.ssh/known_hosts

      - name: Sync project to server
        run: |
          rsync -az --delete \
            --exclude ".git" \
            --exclude "target" \
            --exclude "notes" \
            --exclude "node_modules" \
            ./ "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:${{ secrets.DEPLOY_PATH }}/"

      - name: Write environment file
        run: |
          ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
            "mkdir -p '${{ secrets.DEPLOY_PATH }}' && cat > '${{ secrets.DEPLOY_PATH }}/.env'" \
            <<< "${{ secrets.DEPLOY_ENV_FILE }}"

      - name: Deploy with Docker Compose
        run: |
          ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "
            set -e
            cd '${{ secrets.DEPLOY_PATH }}'
            docker compose config -q
            docker compose up -d --build --remove-orphans
          "

      - name: Verify health endpoints
        run: |
          ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "
            set -e
            cd '${{ secrets.DEPLOY_PATH }}'
            for attempt in \$(seq 1 30); do
              if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \
                && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \
                && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then
                exit 0
              fi
              sleep 2
            done
            echo 'deployment health verification failed' >&2
            docker compose ps >&2
            exit 1
          "