name: deploy

on:
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
  workflow_dispatch:   

jobs:
  test:
    runs-on: ubuntu-latest  
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - run: npm run typecheck
      - run: npm test
      - run: npm run build
      - run: python3 -m unittest discover -s hermes-plugin/srs-gate -v

  deploy:
    needs: test
    runs-on: ubuntu-latest   
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to the VPS
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key && chmod 600 ~/.ssh/deploy_key
          ssh-keygen -y -f ~/.ssh/deploy_key > /dev/null \
            || { echo "ERROR: DEPLOY_SSH_KEY is not a valid private key"; exit 1; }
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          SSH="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=15 -o ServerAliveInterval=30 -o ServerAliveCountMax=6 srs@$DEPLOY_HOST"

          # send exactly the commit that was tested, then run its deploy script, all under one lock
          git archive --format=tar.gz "$GITHUB_SHA" \
            | $SSH 'flock -w 900 ~/.srs-deploy.lock bash -c "rm -rf ~/srs-api.new && mkdir ~/srs-api.new && tar -xz -C ~/srs-api.new && bash ~/srs-api.new/deploy/deploy.sh"'