name: Test and deploy

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  verify:
    name: Verify production build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Type-check
        run: npm run typecheck

      - name: Build standalone Next.js application
        run: npm run build

      - name: Test standalone runtime
        run: npm test

      - name: Audit production dependencies
        run: npm audit --audit-level=high

  deploy:
    name: Deploy production
    needs: verify
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      RELEASE_ID: ${{ gitea.sha }}
      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
      DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
      DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
      DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
      DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
      SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Configure SSH
        shell: bash
        run: |
          set -Eeuo pipefail
          : "${DEPLOY_HOST:?DEPLOY_HOST secret is required}"
          : "${DEPLOY_USER:?DEPLOY_USER secret is required}"
          : "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
          : "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}"
          : "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}"

          install -d -m 700 "$HOME/.ssh"
          printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
          chmod 600 "$HOME/.ssh/deploy_key"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/known_hosts"

      - name: Package release
        shell: bash
        run: |
          set -Eeuo pipefail
          git archive \
            --format=tar.gz \
            --output="$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
            HEAD

      - name: Upload and activate release
        shell: bash
        run: |
          set -Eeuo pipefail
          DEPLOY_PORT="${DEPLOY_PORT:-22}"
          remote_archive="/tmp/portfolio-$RELEASE_ID.tar.gz"
          ssh_options=(
            -i "$HOME/.ssh/deploy_key"
            -o BatchMode=yes
            -o StrictHostKeyChecking=yes
            -p "$DEPLOY_PORT"
          )

          scp \
            -i "$HOME/.ssh/deploy_key" \
            -o BatchMode=yes \
            -o StrictHostKeyChecking=yes \
            -P "$DEPLOY_PORT" \
            "$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
            "$DEPLOY_USER@$DEPLOY_HOST:$remote_archive"

          printf -v remote_command \
            'bash -s -- %q %q %q' \
            "$DEPLOY_PATH" "$RELEASE_ID" "$remote_archive"

          ssh "${ssh_options[@]}" \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            "$remote_command" \
            < scripts/deploy-release.sh