name: deploy
on:
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Check out the code
        uses: actions/checkout@v4
      - name: Get Flutter 3.44.1
        run: |
          git clone --depth 1 --branch 3.44.1 https://github.com/flutter/flutter.git "$RUNNER_TEMP/flutter"
          echo "$RUNNER_TEMP/flutter/bin" >> "$GITHUB_PATH"
          "$RUNNER_TEMP/flutter/bin/flutter" config --no-analytics --no-cli-animations

      - name: Install packages
        run: flutter pub get --enforce-lockfile
      - name: Analyze
        run: flutter analyze
      - name: Run tests
        run: flutter test
      - name: Build the web app
        run: flutter build web --release

      - name: Put it live on the VPS
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key && chmod 600 ~/.ssh/deploy_key
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          SSH="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=15 srs@$DEPLOY_HOST"

          # Unpack into releases/<commit>, switch `current` to it in one step, keep the newest 3.
          tar -czf - -C build/web . | $SSH "flock -w 300 ~/.srs-web-deploy.lock bash -c '
            set -euo pipefail
            cd /var/www/srs-pwa && mkdir -p releases
            rm -rf releases/$GITHUB_SHA releases/.incoming && mkdir releases/.incoming
            tar -xz -C releases/.incoming && mv releases/.incoming releases/$GITHUB_SHA
            ln -sfn releases/$GITHUB_SHA current.new && mv -Tf current.new current
            ls -1t releases | tail -n +4 | xargs -r -I{} rm -rf releases/{}
            echo Live: \$(readlink current)
          '"