# ----------------------------------------------------------------------------
# Build + deploy jb-website.
#
# Runs on the home-desktop host runner (label `desktop`): builds the image,
# pushes it to the Forgejo container registry, then SSHes to the VPS to pull
# and restart. The VPS never builds — it only runs the prebuilt image.
#
# Required Forgejo settings (Repo > Settings > Actions):
#   Variables:
#     REGISTRY_OWNER   lowercase Forgejo user/org that owns the package
#   Secrets:
#     REGISTRY_USER    Forgejo username for `docker login`
#     REGISTRY_TOKEN   Forgejo PAT with write:package scope
#     DEPLOY_HOST      VPS host/IP
#     DEPLOY_USER      SSH user on the VPS (deploy account)
#     DEPLOY_SSH_KEY   private key whose public half is in the VPS authorized_keys
# ----------------------------------------------------------------------------

name: deploy

on:
  push:
    branches: [main]

env:
  REGISTRY: git.joshbairstow.com
  IMAGE_NAME: jb-website

jobs:
  build-and-deploy:
    runs-on: desktop
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve image reference
        run: |
          IMAGE="${REGISTRY}/${{ vars.REGISTRY_OWNER }}/${IMAGE_NAME}"
          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
          echo "Building ${IMAGE}:${{ github.sha }}"

      - name: Log in to the Forgejo registry
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" \
            | docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      - name: Build and push image
        run: |
          docker build -t "${IMAGE}:${{ github.sha }}" -t "${IMAGE}:latest" .
          docker push "${IMAGE}:${{ github.sha }}"
          docker push "${IMAGE}:latest"

      - name: Deploy to VPS over SSH
        run: |
          install -m 600 /dev/null deploy_key
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > deploy_key
          ssh -i deploy_key -o StrictHostKeyChecking=accept-new \
            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
            "export REGISTRY_OWNER='${{ vars.REGISTRY_OWNER }}' TAG='${{ github.sha }}'; \
             cd /opt/jb-website && \
             docker compose -f compose.yml pull && \
             docker compose -f compose.yml up -d && \
             docker image prune -f"
          rm -f deploy_key