name: Deploy admin to VPS

# act_runner job containers have no Docker daemon. Build on the VPS (same
# pattern as telegrambot) after rsyncing sources.
on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-admin-production
  cancel-in-progress: true

jobs:
  deploy:
    name: Rsync and deploy admin
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v4

      - name: Deploy over SSH
        env:
          SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
          VPS_HOST: ${{ secrets.VPS_HOST }}
          VPS_USER: ${{ secrets.VPS_USER }}
        run: |
          set -euo pipefail
          test -n "${SSH_KEY:-}"
          test -n "${VPS_HOST:-}"
          test -n "${VPS_USER:-}"

          # act_runner images are minimal; telegrambot deploy installs these too.
          if ! command -v rsync >/dev/null 2>&1 || ! command -v ssh >/dev/null 2>&1; then
            apt-get update -qq
            apt-get install -y -qq rsync openssh-client
          fi

          install -m 700 -d "$HOME/.ssh"
          printf '%s\n' "$SSH_KEY" > "$HOME/.ssh/deploy_key"
          chmod 600 "$HOME/.ssh/deploy_key"

          SSH=(ssh -i "$HOME/.ssh/deploy_key" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new)

          "${SSH[@]}" "${VPS_USER}@${VPS_HOST}" '
            set -eu
            install -d -m 0750 /opt/ghabilee-admin /opt/ghabilee-admin/src
            test -s /opt/ghabilee-admin/.env
          '

          rsync -az --delete \
            -e "ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" \
            --exclude '.git' \
            --exclude 'node_modules' \
            --exclude '.next' \
            --exclude '.env' \
            --exclude '.env.*' \
            --exclude 'test-results' \
            --exclude 'playwright-report' \
            ./ "${VPS_USER}@${VPS_HOST}:/opt/ghabilee-admin/src/"

          "${SSH[@]}" "${VPS_USER}@${VPS_HOST}" \
            'chmod +x /opt/ghabilee-admin/src/scripts/deploy-on-vps.sh && APP_DIR=/opt/ghabilee-admin SRC_DIR=/opt/ghabilee-admin/src /opt/ghabilee-admin/src/scripts/deploy-on-vps.sh'

          rm -f "$HOME/.ssh/deploy_key"

      - name: Notify Telegram
        if: always()
        continue-on-error: true
        env:
          DEPLOY_SHA: ${{ github.sha }}
          DEPLOY_STATUS: ${{ job.status }}
          DEPLOY_COMMIT_SUBJECT: ${{ github.event.head_commit.message }}
          SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
          VPS_HOST: ${{ secrets.VPS_HOST }}
          VPS_USER: ${{ secrets.VPS_USER }}
        run: |
          export DEPLOY_VERSION="$(node -p "require('./package.json').version" 2>/dev/null || echo '?')"
          case "${DEPLOY_STATUS}" in
            success) export DEPLOY_STATUS=success ;;
            *) export DEPLOY_STATUS=failed ;;
          esac
          chmod +x scripts/notify-via-vps.sh scripts/notify-ops-telegram.sh scripts/notify-deploy.sh
          # Creds from Iran VPS .env; send from this foreign runner (Telegram blocked in Iran).
          ./scripts/notify-via-vps.sh