# Every push to main deploys everything: Traefik first, then each stack under
# stacks/. The runner only uploads; the server validates, deploys and
# smoke-tests (deploy/deploy.sh), so this job needs no Docker of its own.
name: deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

# Serializes CI runs; deploy.sh's host lock also covers manual rollbacks.
concurrency:
  group: deploy-petrolyst
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
    steps:
      - uses: actions/checkout@v4

      - name: Lint shell scripts
        run: |
          if ! command -v shellcheck >/dev/null; then
            SUDO=$(command -v sudo || true)
            $SUDO apt-get update -qq && $SUDO apt-get install -y -qq shellcheck
          fi
          shellcheck -x host/*.sh deploy/*.sh stacks/*/superset/init.sh stacks/*/fuel-db/init/*.sh

      - name: Install the deploy key
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -d -m 0700 "$HOME/.ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
          chmod 0600 "$HOME/.ssh/deploy_key"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          command -v rsync >/dev/null || { SUDO=$(command -v sudo || true); $SUDO apt-get install -y -qq rsync; }

      - name: Upload and deploy
        run: |
          ssh_cmd="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
          # A fresh directory per run; only deploy.sh, under the host lock,
          # turns it into releases/<sha>. --omit-dir-times: the upload's age
          # must be the server's, because retention prunes uploads by mtime.
          incoming="/opt/petrolyst/incoming/${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}-$(date -u +%s)"
          rsync -az --omit-dir-times --exclude .git -e "$ssh_cmd" ./ "deploy@${DEPLOY_HOST}:${incoming}/"
          $ssh_cmd "deploy@${DEPLOY_HOST}" "${incoming}/deploy/deploy.sh" "$GITHUB_SHA" "$incoming"

      - name: Check from outside
        run: |
          test "$(curl -fsS --max-time 20 https://atoma.petrolyst.com/health)" = OK
          curl -fsS --max-time 20 -o /dev/null -w '%{http_code}\n' https://traefik.petrolyst.com/ | grep -qx 302