ladill-pos/.gitea/workflows/deploy.yml

name: Deploy Ladill POS

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-pos
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: deploy
    env:
      NODE_ROOT: /tmp/ladill-node-22-r1
      NODE_VERSION: "22.14.0"
      RELEASE_ARCHIVE: /tmp/ladill-pos-release-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tgz
      WORKSPACE: /tmp/${{ gitea.repository_owner }}-pos-${{ gitea.run_id }}-${{ gitea.run_attempt }}
      LADILL_APP_ROOT: /var/www/ladill-pos
    steps:
      - name: Guard deploy target
        # Refuse to deploy if this workflow was copied from another service
        # without retargeting LADILL_APP_ROOT. The app dir basename MUST match
        # the repo name (ladill-pos -> /var/www/ladill-pos), otherwise a copied
        # pipeline would clobber a sibling service. See DEPLOY.md "Forking this pipeline".
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          REPO_NAME="${{ gitea.repository }}"; REPO_NAME="${REPO_NAME##*/}"
          APP_DIR_NAME="$(basename "$LADILL_APP_ROOT")"
          if [ "$REPO_NAME" != "$APP_DIR_NAME" ]; then
            echo "FATAL: repo '$REPO_NAME' != deploy target '$APP_DIR_NAME' (LADILL_APP_ROOT=$LADILL_APP_ROOT)." >&2
            echo "Refusing to deploy — a mis-targeted workflow would overwrite another service. Retarget deploy.yml env." >&2
            exit 1
          fi
          echo "Guard OK: $REPO_NAME -> $LADILL_APP_ROOT"

      - name: Checkout
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          DEPLOY_GITEA_TOKEN="$(cat /home/deploy/.ladill-deploy-gitea-token)"
          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
          rm -rf "$WORKSPACE"
          mkdir -p "$WORKSPACE"
          export GIT_TERMINAL_PROMPT=0
          git \
            -c credential.helper= \
            -c http.extraHeader="Authorization: token ${DEPLOY_GITEA_TOKEN}" \
            clone --depth 1 --single-branch --no-tags --branch "${{ gitea.ref_name }}" \
            "$REPO_URL" "$WORKSPACE"

      - name: Setup Node.js
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          if [ ! -x "$NODE_ROOT/bin/node" ]; then
            rm -rf "$NODE_ROOT"
            mkdir -p "$NODE_ROOT"
            case "$(uname -m)" in
              x86_64|amd64) NODE_ARCH="x64" ;;
              aarch64|arm64) NODE_ARCH="arm64" ;;
              *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
            esac
            curl -fsSL "https://nodejs.org/download/release/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
              | tar -xJ --strip-components=1 -C "$NODE_ROOT"
          fi
          "$NODE_ROOT/bin/node" -v

      - name: Build frontend assets
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          cd "$WORKSPACE"
          export PATH="$NODE_ROOT/bin:$PATH"
          npm ci --no-audit --no-fund
          npm run build

      - name: Build release archive
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          cd "$WORKSPACE"
          printf '%s\n' "${{ gitea.sha }}" > REVISION
          rm -f "$RELEASE_ARCHIVE"
          tar -czf "$RELEASE_ARCHIVE" \
            --exclude=.git --exclude=.gitea --exclude=.github --exclude=.env \
            --exclude=node_modules --exclude=vendor --exclude=storage --exclude=tests .

      - name: Deploy release
        shell: bash {0}
        env:
          LADILL_RELEASE_ARCHIVE: /tmp/ladill-pos-release-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tgz
        run: |
          set -Eeuo pipefail
          : "${LADILL_APP_ROOT:?Set LADILL_APP_ROOT}"
          bash "$WORKSPACE/deploy/deploy.sh"

      - name: Ensure nginx vhost
        shell: bash {0}
        run: |
          set -Eeuo pipefail
          NGINX_SCRIPT="$WORKSPACE/deployment/setup-service-subdomain-nginx.sh"
          if [ ! -f "$NGINX_SCRIPT" ]; then
            NGINX_SCRIPT="/var/www/ladill.com/current/deployment/setup-service-subdomain-nginx.sh"
          fi
          if [ ! -f "$NGINX_SCRIPT" ]; then
            echo "WARN: setup-service-subdomain-nginx.sh not found — configure pos.ladill.com vhost manually"
            exit 0
          fi
          if sudo -n bash "$NGINX_SCRIPT" pos --app /var/www/ladill-pos/current; then
            echo "nginx vhost updated for pos.ladill.com"
          else
            echo "WARN: nginx vhost step skipped (deploy user cannot sudo) — vhost must already be provisioned"
          fi

      - name: Cleanup
        if: always()
        shell: bash {0}
        run: |
          rm -rf "$WORKSPACE"
          rm -f "$RELEASE_ARCHIVE"