name: Build and deploy

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    env:
      DOMAIN: ${{ vars.DOMAIN }}
      IMAGE: ${{ vars.IMAGE }}
      IMAGE_REPO: ${{ vars.IMAGE_REPO }}
      PUSH_LATEST: ${{ vars.PUSH_LATEST }}
      REGISTRY: ${{ vars.REGISTRY }}
      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
      STACK_NAME: ${{ vars.STACK_NAME }}
      TRAEFIK_NETWORK: ${{ vars.TRAEFIK_NETWORK }}
      TRAEFIK_ENTRYPOINT: ${{ vars.TRAEFIK_ENTRYPOINT }}
      DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
      DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
      DEPLOY_USER: ${{ vars.DEPLOY_USER }}
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Prepare image name
        shell: bash
        run: |
          set -euo pipefail

          short_sha="${GITHUB_SHA:-${GITEA_SHA:-manual}}"
          short_sha="${short_sha:0:12}"

          if [ -z "${IMAGE}" ]; then
            : "${IMAGE_REPO:?Set IMAGE or IMAGE_REPO in Gitea variables}"
            IMAGE="${IMAGE_REPO}:${short_sha}"
          fi

          if [ -z "${IMAGE_REPO}" ]; then
            IMAGE_REPO="${IMAGE%:*}"
          fi

          {
            echo "IMAGE=${IMAGE}"
            echo "IMAGE_REPO=${IMAGE_REPO}"
            echo "IMAGE_TAG=${short_sha}"
            echo "STACK_NAME=${STACK_NAME:-progcode}"
            echo "TRAEFIK_NETWORK=${TRAEFIK_NETWORK:-traefik-public}"
            echo "TRAEFIK_ENTRYPOINT=${TRAEFIK_ENTRYPOINT:-websecure}"
            echo "DEPLOY_PORT=${DEPLOY_PORT:-22}"
          } >> "${GITHUB_ENV}"

      - name: Docker login
        shell: bash
        run: |
          set -euo pipefail

          if [ -n "${REGISTRY_PASSWORD}" ]; then
            : "${REGISTRY:?Set REGISTRY when REGISTRY_PASSWORD is configured}"
            : "${REGISTRY_USER:?Set REGISTRY_USER secret when REGISTRY_PASSWORD is configured}"
            echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
          else
            echo "REGISTRY_PASSWORD is not set; skipping docker login"
          fi

      - name: Build image
        shell: bash
        run: |
          set -euo pipefail
          docker build --pull -t "${IMAGE}" .

      - name: Push image
        shell: bash
        run: |
          set -euo pipefail

          docker push "${IMAGE}"

          if [ "${PUSH_LATEST:-false}" = "true" ]; then
            latest_image="${IMAGE_REPO}:latest"
            docker tag "${IMAGE}" "${latest_image}"
            docker push "${latest_image}"
          fi

      - name: Configure remote Docker host
        if: ${{ vars.DEPLOY_HOST != '' }}
        shell: bash
        run: |
          set -euo pipefail
          : "${DEPLOY_USER:?Set DEPLOY_USER when DEPLOY_HOST is configured}"
          : "${DEPLOY_SSH_KEY:?Set DEPLOY_SSH_KEY secret when DEPLOY_HOST is configured}"

          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printf '%s\n' "${DEPLOY_SSH_KEY}" > "${HOME}/.ssh/id_deploy"
          chmod 600 "${HOME}/.ssh/id_deploy"
          ssh-keyscan -p "${DEPLOY_PORT}" "${DEPLOY_HOST}" >> "${HOME}/.ssh/known_hosts"

          cat > "${HOME}/.ssh/config" <<EOF
          Host swarm-manager
            HostName ${DEPLOY_HOST}
            Port ${DEPLOY_PORT}
            User ${DEPLOY_USER}
            IdentityFile ${HOME}/.ssh/id_deploy
            IdentitiesOnly yes
          EOF

          echo "DOCKER_HOST=ssh://swarm-manager" >> "${GITHUB_ENV}"

      - name: Deploy stack
        shell: bash
        run: |
          set -euo pipefail
          : "${DOMAIN:?Set DOMAIN in Gitea variables}"

          docker stack deploy \
            --with-registry-auth \
            -c deploy/stack.example.yml \
            "${STACK_NAME}"