name: Validate and deploy production

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: shd-build-production
  cancel-in-progress: false

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Validate application
        run: npm run check

      - name: Build Node application
        run: npm run build:app

  deploy:
    needs: validate
    runs-on: stage-deploy
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install environment tooling
        run: npm ci

      - name: Prepare production configuration
        env:
          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
          SCHEDULER_TOKEN_PRODUCTION: ${{ secrets.SCHEDULER_TOKEN_PRODUCTION }}
          CONFIGURED_DEPLOY_PATH: ${{ vars.PRODUCTION_DEPLOY_PATH }}
          CONFIGURED_PRODUCTION_PORT: ${{ vars.PRODUCTION_PORT }}
          COMMIT_SHA: ${{ gitea.sha }}
          BUILD_NUMBER: ${{ gitea.run_number }}
        run: |
          set -eu
          : "${DOTENV_PRIVATE_KEY_PRODUCTION:?DOTENV_PRIVATE_KEY_PRODUCTION is required}"
          : "${SCHEDULER_TOKEN_PRODUCTION:?SCHEDULER_TOKEN_PRODUCTION is required}"
          deployment_path="${CONFIGURED_DEPLOY_PATH:-/opt/shd-build-production}"
          production_port="${CONFIGURED_PRODUCTION_PORT:-3102}"
          mkdir -p "$deployment_path"
          cp deploy/compose.production.yml deploy/deploy-production.sh deploy/bootstrap-production.sh deploy/sync-production-isac-to-staging.sh "$deployment_path/"
          DOTENV_PRIVATE_KEY_PRODUCTION="$DOTENV_PRIVATE_KEY_PRODUCTION" npx dotenvx decrypt -f .env.production --stdout > "$deployment_path/.env.production.runtime"
          printf '\nSCHEDULER_TOKEN=%s\n' "$SCHEDULER_TOKEN_PRODUCTION" >> "$deployment_path/.env.production.runtime"
          printf 'SHD_IMAGE=shd-build-production:%s\nSHD_PRODUCTION_PORT=%s\nSHD_BUILD_NUMBER=%s\n' "$COMMIT_SHA" "$production_port" "$BUILD_NUMBER" > "$deployment_path/.env.deploy"
          chmod 600 "$deployment_path/.env.production.runtime" "$deployment_path/.env.deploy"
          chmod 755 "$deployment_path/deploy-production.sh" "$deployment_path/bootstrap-production.sh" "$deployment_path/sync-production-isac-to-staging.sh"

      - name: Deploy production
        env:
          CONFIGURED_DEPLOY_PATH: ${{ vars.PRODUCTION_DEPLOY_PATH }}
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          deployment_path="${CONFIGURED_DEPLOY_PATH:-/opt/shd-build-production}"
          "$deployment_path/deploy-production.sh" "$deployment_path" "$GITHUB_WORKSPACE" "shd-build-production:$COMMIT_SHA"

      - name: Remove unused application images
        if: success()
        run: docker image prune --force --filter "label=org.opencontainers.image.title=shd-build"