name: Build and deploy

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    env:
      DOMAIN: ${{ vars.DOMAIN }}
      IMAGE: ${{ vars.IMAGE }}
      IMAGE_REPO: ${{ vars.IMAGE_REPO }}
      REGISTRY: ${{ vars.REGISTRY }}
      REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
      STACK_NAME: ${{ vars.STACK_NAME }}
      TRAEFIK_NETWORK: ${{ vars.TRAEFIK_NETWORK }}
      TRAEFIK_ENTRYPOINT: ${{ vars.TRAEFIK_ENTRYPOINT }}
      SWARM_MANAGER_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
      SWARM_SSH_USER: ${{ secrets.SWARM_SSH_USER }}
      SWARM_SSH_PORT: ${{ secrets.SWARM_SSH_PORT }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Prepare image name
        shell: bash
        run: |
          set -euo pipefail

          short_sha="${GITHUB_SHA:-${GITEA_SHA:-manual}}"
          short_sha="${short_sha:0:12}"

          if [ -z "${IMAGE}" ]; then
            : "${IMAGE_REPO:?Set IMAGE or IMAGE_REPO in Gitea variables}"
            IMAGE="${IMAGE_REPO}:${short_sha}"
          fi

          if [ -z "${IMAGE_REPO}" ]; then
            IMAGE_REPO="${IMAGE%:*}"
          fi

          {
            echo "IMAGE=${IMAGE}"
            echo "IMAGE_REPO=${IMAGE_REPO}"
            echo "IMAGE_TAG=${short_sha}"
            echo "STACK_NAME=${STACK_NAME:-progcode}"
            echo "TRAEFIK_NETWORK=${TRAEFIK_NETWORK:-traefik-public}"
            echo "TRAEFIK_ENTRYPOINT=${TRAEFIK_ENTRYPOINT:-websecure}"
            echo "SWARM_SSH_PORT=${SWARM_SSH_PORT:-22}"
          } >> "${GITHUB_ENV}"

      - name: Docker login
        shell: bash
        run: |
          set -euo pipefail

          if [ -n "${REGISTRY_PASSWORD}" ]; then
            : "${REGISTRY:?Set REGISTRY when REGISTRY_PASSWORD is configured}"
            : "${REGISTRY_USERNAME:?Set REGISTRY_USERNAME secret when REGISTRY_PASSWORD is configured}"
            echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USERNAME}" --password-stdin
          else
            echo "REGISTRY_PASSWORD is not set; skipping docker login"
          fi

      - name: Build image
        shell: bash
        run: |
          set -euo pipefail
          docker build --pull -t "${IMAGE}" .

      - name: Push image
        shell: bash
        run: |
          set -euo pipefail

          docker push "${IMAGE}"

          latest_image="${IMAGE_REPO}:latest"
          if [ "${IMAGE}" != "${latest_image}" ]; then
            docker tag "${IMAGE}" "${latest_image}"
            docker push "${latest_image}"
          fi

      - name: Configure remote Docker host
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${SWARM_MANAGER_HOST}" ]; then
            echo "SWARM_MANAGER_HOST is not set; using the local Docker daemon"
            exit 0
          fi

          : "${SWARM_SSH_USER:?Set SWARM_SSH_USER when SWARM_MANAGER_HOST is configured}"

          ssh -p "${SWARM_SSH_PORT}" \
            -o BatchMode=yes \
            "${SWARM_SSH_USER}@${SWARM_MANAGER_HOST}" \
            "docker info >/dev/null"

          echo "DOCKER_HOST=ssh://${SWARM_SSH_USER}@${SWARM_MANAGER_HOST}:${SWARM_SSH_PORT}" >> "${GITHUB_ENV}"

      - name: Deploy stack
        shell: bash
        run: |
          set -euo pipefail
          : "${DOMAIN:?Set DOMAIN in Gitea variables}"

          docker stack deploy \
            --with-registry-auth \
            -c deploy/stack.example.yml \
            "${STACK_NAME}"