name: Verify Caterium on Timeweb

on:
  workflow_run:
    workflows: ["Caterium QA"]
    types: [completed]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: caterium-timeweb-production
  cancel-in-progress: false

jobs:
  verify:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.head_branch == 'production')
    runs-on: ubuntu-latest
    env:
      TIMEWEB_BASE_URL: https://app.caterium.ru

    steps:
      - name: Checkout tested production revision
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'production' }}

      - name: Wait for Timeweb cron deployment
        shell: bash
        run: |
          set -euo pipefail

          login_file="public/core/login-signature-v1776.js"
          logo_file="public/caterium-mark-light.svg"

          test -s "$login_file"
          test -s "$logo_file"

          local_login="$(sha256sum "$login_file" | awk '{print $1}')"
          local_logo="$(sha256sum "$logo_file" | awk '{print $1}')"

          echo "Expected login sha256: $local_login"
          echo "Expected logo sha256:  $local_logo"

          for attempt in $(seq 1 18); do
            stamp="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${attempt}"
            echo "Attempt $attempt/18"

            if curl -fsSL --connect-timeout 10 --max-time 30 \
                "${TIMEWEB_BASE_URL}/core/login-signature-v1776.js?deploy_check=${stamp}" \
                -o /tmp/caterium-login.js && \
               curl -fsSL --connect-timeout 10 --max-time 30 \
                "${TIMEWEB_BASE_URL}/caterium-mark-light.svg?deploy_check=${stamp}" \
                -o /tmp/caterium-mark.svg; then
              remote_login="$(sha256sum /tmp/caterium-login.js | awk '{print $1}')"
              remote_logo="$(sha256sum /tmp/caterium-mark.svg | awk '{print $1}')"

              echo "Remote login sha256: $remote_login"
              echo "Remote logo sha256:  $remote_logo"

              if [ "$remote_login" = "$local_login" ] && [ "$remote_logo" = "$local_logo" ]; then
                echo "Timeweb production is current."
                exit 0
              fi
            else
              echo "Timeweb is not reachable yet."
            fi

            sleep 30
          done

          echo "::error::Timeweb did not reach the tested Caterium login revision within 9 minutes."
          exit 1