name: Deploy Caterium to Timeweb Hosting

on:
  workflow_run:
    workflows: ["Caterium QA"]
    types: [completed]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: caterium-timeweb-production
  cancel-in-progress: false

jobs:
  deploy:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.head_branch == 'production')
    runs-on: ubuntu-latest
    env:
      TIMEWEB_HOST: ${{ secrets.TIMEWEB_HOST }}
      TIMEWEB_USER: ${{ secrets.TIMEWEB_USER }}
      TIMEWEB_SSH_KEY: ${{ secrets.TIMEWEB_SSH_KEY }}
      TIMEWEB_REMOTE_PATH: ${{ secrets.TIMEWEB_REMOTE_PATH }}

    steps:
      - name: Check Timeweb configuration
        id: config
        shell: bash
        run: |
          missing=0
          for name in TIMEWEB_HOST TIMEWEB_USER TIMEWEB_SSH_KEY TIMEWEB_REMOTE_PATH; do
            if [ -z "${!name}" ]; then
              echo "::notice::$name is not configured yet"
              missing=1
            fi
          done

          if [ "$missing" -eq 0 ]; then
            echo "ready=true" >> "$GITHUB_OUTPUT"
          else
            echo "ready=false" >> "$GITHUB_OUTPUT"
            echo "Timeweb deployment is prepared but inactive until all four repository secrets are configured."
          fi

      - name: Checkout tested production revision
        if: steps.config.outputs.ready == 'true'
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'production' }}

      - name: Configure SSH
        if: steps.config.outputs.ready == 'true'
        shell: bash
        run: |
          install -m 700 -d "$HOME/.ssh"
          printf '%s\n' "$TIMEWEB_SSH_KEY" > "$HOME/.ssh/timeweb_deploy_key"
          chmod 600 "$HOME/.ssh/timeweb_deploy_key"
          ssh-keyscan -p 22 -H "$TIMEWEB_HOST" >> "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/known_hosts"

      - name: Verify Timeweb target
        if: steps.config.outputs.ready == 'true'
        shell: bash
        run: |
          test -f public/index.html
          ssh -p 22 -i "$HOME/.ssh/timeweb_deploy_key" \
            -o BatchMode=yes \
            -o IdentitiesOnly=yes \
            "$TIMEWEB_USER@$TIMEWEB_HOST" \
            "mkdir -p -- '$TIMEWEB_REMOTE_PATH'"

      - name: Deploy public directory
        if: steps.config.outputs.ready == 'true'
        shell: bash
        run: |
          rsync -az --delete --checksum \
            --exclude='.htaccess' \
            --exclude='.well-known/' \
            -e "ssh -p 22 -i $HOME/.ssh/timeweb_deploy_key -o BatchMode=yes -o IdentitiesOnly=yes" \
            public/ \
            "$TIMEWEB_USER@$TIMEWEB_HOST:$TIMEWEB_REMOTE_PATH/"

      - name: Verify deployed entry point
        if: steps.config.outputs.ready == 'true'
        shell: bash
        run: |
          ssh -p 22 -i "$HOME/.ssh/timeweb_deploy_key" \
            -o BatchMode=yes \
            -o IdentitiesOnly=yes \
            "$TIMEWEB_USER@$TIMEWEB_HOST" \
            "test -s '$TIMEWEB_REMOTE_PATH/index.html'"