name: Build and deploy

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  verify:
    name: Verify production build
    if: gitea.event_name == 'workflow_dispatch' || (gitea.event_name == 'pull_request' && gitea.event.pull_request.head.repo.full_name == gitea.repository)
    runs-on: portfolio-ci
    timeout-minutes: 15
    env:
      PORTFOLIO_IMAGE: portfolio-check:${{ gitea.sha }}
      NPM_REGISTRY: ${{ vars.NPM_REGISTRY }}
    steps:
      - uses: actions/checkout@v4
      - name: Compile once, including TypeScript validation
        run: docker compose build
      - name: Remove check image
        if: always()
        run: docker image rm "$PORTFOLIO_IMAGE" >/dev/null 2>&1 || true

  deploy:
    name: Deploy with Compose
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    runs-on: portfolio-ci
    timeout-minutes: 15
    env:
      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
      DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
      DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
      DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
      DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
      REVISION: ${{ gitea.sha }}
    steps:
      - uses: actions/checkout@v4
      - name: Update checkout and build on the server
        shell: bash
        run: |
          set -Eeuo pipefail
          : "${DEPLOY_HOST:?Missing DEPLOY_HOST}"
          : "${DEPLOY_USER:?Missing DEPLOY_USER}"
          : "${DEPLOY_PATH:?Missing DEPLOY_PATH}"
          : "${DEPLOY_SSH_KEY:?Missing DEPLOY_SSH_KEY}"
          : "${DEPLOY_KNOWN_HOSTS:?Missing DEPLOY_KNOWN_HOSTS}"
          ssh_directory="$(mktemp -d)"
          trap 'rm -rf -- "$ssh_directory"' EXIT
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$ssh_directory/key"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$ssh_directory/known_hosts"
          chmod 600 "$ssh_directory/key"
          printf -v command 'bash -s -- %q %q' "$DEPLOY_PATH" "$REVISION"
          ssh -i "$ssh_directory/key" -p "${DEPLOY_PORT:-22}" \
            -o BatchMode=yes -o StrictHostKeyChecking=yes \
            -o "UserKnownHostsFile=$ssh_directory/known_hosts" \
            "$DEPLOY_USER@$DEPLOY_HOST" "$command" < scripts/deploy-release.sh