name: Deploy Ladill Meet

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-meet
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: deploy
    env:
      NODE_ROOT: /tmp/ladill-node-22-r1
      NODE_VERSION: "22.14.0"
      # act_runner v0.2.x does not expose gitea.run_attempt — use run_id only.
      RELEASE_ARCHIVE: /tmp/ladill-meet-release-${{ gitea.run_id }}.tgz
      WORKSPACE: /tmp/${{ gitea.repository_owner }}-meet-${{ gitea.run_id }}
      LADILL_APP_ROOT: /var/www/ladill-meet
    steps:
      - name: Checkout
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          DEPLOY_GITEA_TOKEN="$(cat /home/deploy/.ladill-deploy-gitea-token)"
          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
          rm -rf "$WORKSPACE"
          mkdir -p "$WORKSPACE"
          export GIT_TERMINAL_PROMPT=0
          git \
            -c credential.helper= \
            -c http.extraHeader="Authorization: token ${DEPLOY_GITEA_TOKEN}" \
            clone --depth 1 --single-branch --no-tags --branch "${{ gitea.ref_name }}" \
            "$REPO_URL" "$WORKSPACE"

      - name: Setup Node.js
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          if [ ! -x "$NODE_ROOT/bin/node" ]; then
            rm -rf "$NODE_ROOT"
            mkdir -p "$NODE_ROOT"
            case "$(uname -m)" in
              x86_64|amd64) NODE_ARCH="x64" ;;
              aarch64|arm64) NODE_ARCH="arm64" ;;
              *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
            esac
            curl -fsSL "https://nodejs.org/download/release/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
              | tar -xJ --strip-components=1 -C "$NODE_ROOT"
          fi
          "$NODE_ROOT/bin/node" -v

      - name: Build frontend assets
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          cd "$WORKSPACE"
          export PATH="$NODE_ROOT/bin:$PATH"
          npm ci --no-audit --no-fund
          npm run build

      - name: Build release archive
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          cd "$WORKSPACE"
          printf '%s\n' "${{ gitea.sha }}" > REVISION
          rm -f "$RELEASE_ARCHIVE"
          tar -czf "$RELEASE_ARCHIVE" \
            --exclude=.git --exclude=.gitea --exclude=.github --exclude=.env \
            --exclude=node_modules --exclude=vendor --exclude=storage --exclude=tests .

      - name: Deploy release
        shell: bash {0}
        env:
          LADILL_RELEASE_ARCHIVE: /tmp/ladill-meet-release-${{ gitea.run_id }}.tgz
        run: |
          set -Eeuo pipefail
          : "${LADILL_APP_ROOT:?Set LADILL_APP_ROOT}"
          bash "$WORKSPACE/deploy/deploy.sh"

      - name: Ensure nginx vhost
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          NGINX_SCRIPT="$WORKSPACE/deployment/setup-service-subdomain-nginx.sh"
          if [ ! -f "$NGINX_SCRIPT" ]; then
            NGINX_SCRIPT="/var/www/ladill.com/current/deployment/setup-service-subdomain-nginx.sh"
          fi
          if [ ! -f "$NGINX_SCRIPT" ]; then
            echo "WARN: setup-service-subdomain-nginx.sh not found — configure meet.ladill.com vhost manually"
            exit 0
          fi
          if sudo -n bash "$NGINX_SCRIPT" meet --app /var/www/ladill-meet/current; then
            echo "nginx vhost updated for meet.ladill.com"
          else
            echo "WARN: nginx vhost step skipped (deploy user cannot sudo) — vhost must already be provisioned"
          fi

      - name: Cleanup
        if: always()
        shell: bash {0}
        run: |
          rm -rf "$WORKSPACE"
          rm -f "$RELEASE_ARCHIVE"