name: CI

on:
  push:
    branches:
      - main
      - proof
  workflow_dispatch:

env:
  REGISTRY: git.lukas-harat.com
  IMAGE_NAME: ${{ github.repository }}

permissions:
  contents: read
  packages: write

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npx tsc --noEmit

  build:
    needs: test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ secrets.USERNAME }}
          password: ${{ secrets.TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max

  deploy:
    needs: build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Deploy to TrueNAS
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}

          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
          BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
          BETTER_AUTH_URL: ${{ secrets.BETTER_AUTH_URL }}
          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
          STAFF_SEED_EMAIL: ${{ secrets.STAFF_SEED_EMAIL }}
          STAFF_SEED_PASSWORD: ${{ secrets.STAFF_SEED_PASSWORD }}
          RESERVATIONS_FROM_EMAIL: ${{ secrets.RESERVATIONS_FROM_EMAIL }}

          IMAGE_TAG: ${{ github.sha }}

        run: |
          set -euo pipefail

          mkdir -p ~/.ssh

          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key

          ssh-keyscan \
            -p "${DEPLOY_PORT:-22}" \
            -H "$DEPLOY_HOST" \
            >> ~/.ssh/known_hosts

          echo "Creating deployment directory if needed..."

          ssh \
            -i ~/.ssh/deploy_key \
            -p "${DEPLOY_PORT:-22}" \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            "mkdir -p '$DEPLOY_PATH'"

          echo "Uploading compose file..."

          scp \
            -i ~/.ssh/deploy_key \
            -P "${DEPLOY_PORT:-22}" \
            docker-compose.prod.yml \
            "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/docker-compose.yml"

          echo "Deploying..."

          ssh \
            -i ~/.ssh/deploy_key \
            -p "${DEPLOY_PORT:-22}" \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            "POSTGRES_PASSWORD=$(printf '%q' "$POSTGRES_PASSWORD") \
             BETTER_AUTH_SECRET=$(printf '%q' "$BETTER_AUTH_SECRET") \
             BETTER_AUTH_URL=$(printf '%q' "$BETTER_AUTH_URL") \
             RESEND_API_KEY=$(printf '%q' "$RESEND_API_KEY") \
             RESERVATIONS_FROM_EMAIL=$(printf '%q' "$RESERVATIONS_FROM_EMAIL") \
             STAFF_SEED_EMAIL=$(printf '%q' "$STAFF_SEED_EMAIL") \
             STAFF_SEED_PASSWORD=$(printf '%q' "$STAFF_SEED_PASSWORD") \
             IMAGE_TAG=$(printf '%q' "$IMAGE_TAG") \
             bash -c '
               set -euo pipefail

               cd \"$DEPLOY_PATH\"

               echo \"Pulling images...\"
               docker compose pull

               echo \"Starting PostgreSQL...\"
               docker compose up -d postgres

               echo \"Running database migrations...\"
               docker compose run --rm app npx drizzle-kit migrate

               echo \"Starting application...\"
               docker compose up -d

               echo \"Cleaning unused images...\"
               docker image prune -f

               echo \"Deployment complete.\"
             '"