name: Deploy im-webapp production

on:
  push:
    branches:
      - pro
  workflow_dispatch:

concurrency:
  group: production-im-webapp
  cancel-in-progress: false

permissions:
  contents: read

env:
  REGISTRY: git.olns.shop
  IMAGE: git.olns.shop/pro/im_webapp
  SERVICE: im-webapp
  DEPLOY_HOST: 145.223.69.9
  DEPLOY_USER: olns-deploy

jobs:
  deploy:
    runs-on: deploy-host
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

      - name: Log in to Gitea Container Registry
        env:
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin

      - name: Build and push image
        env:
          TINODE_API_KEY: ${{ secrets.TINODE_API_KEY }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
          TINODE_API_KEY="${TINODE_API_KEY#\'}"
          TINODE_API_KEY="${TINODE_API_KEY%\'}"
          docker build \
            --build-arg TINODE_API_KEY="${TINODE_API_KEY}" \
            --build-arg TINODE_API_BASE="https://im-api.yuexuan.shop/v1/im" \
            --build-arg TINODE_FILE_BASE="https://im-api.yuexuan.shop/v0/file" \
            -t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
          docker push "$IMAGE:pro"
          docker push "$IMAGE:$SHORT_SHA"

      - name: Deploy Compose service
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          install -d -m 700 "$HOME/.ssh"
          KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
          cleanup() {
            shred -u "$KEY_FILE" 2>/dev/null || true
          }
          trap cleanup EXIT
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
          chmod 600 "$KEY_FILE"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/known_hosts"
          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
          printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
            "docker login git.olns.shop -u admin --password-stdin"
          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
            "cd /opt/olns && docker compose pull im-webapp && docker compose up -d --no-deps --wait im-webapp"