name: Deploy

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*'

env:
  WEB_ROOT: /var/www/decepub.thepra.dev
  BACKUPS: /var/backups/decepub.thepra.dev
  PUBLIC_URL: https://decepub.thepra.dev

jobs:
  site:
    name: decepub.thepra.dev
    runs-on: build
    steps:
      - uses: actions/checkout@v4
        with:
          path: decePubClient

      - name: Fetch PrivaPub's client models beside it
        env:
          READ_TOKEN: ${{ secrets.THEPRA_READ_TOKEN }}
        run: |
          rm -rf SocialPub
          git -c http.extraHeader="Authorization: token $READ_TOKEN" clone -q --depth 1 \
            https://git.thepra.dev/thepra/SocialPub.git SocialPub

      - name: Resolve the build identity
        run: |
          echo "BUILD_COMMIT=$(echo "$GITHUB_SHA" | cut -c1-8)" >> "$GITHUB_ENV"
          echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
          echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"

      - name: Publish
        run: |
          rm -rf "$GITHUB_WORKSPACE/publish"
          dotnet publish decePubClient/decePubClient.csproj -c Release -o "$GITHUB_WORKSPACE/publish"
          printf '{"commit":"%s","buildRef":"%s","builtAt":"%s"}\n' "$BUILD_COMMIT" "$BUILD_REF" "$BUILD_TIME" \
            > "$GITHUB_WORKSPACE/publish/wwwroot/build.json"

      - name: Assert the publish actually produced a site
        run: |
          W="$GITHUB_WORKSPACE/publish/wwwroot"
          for f in index.html appsettings.json build.json _framework/blazor.webassembly.js css/style.min.css; do
            [ -e "$W/$f" ] || { echo "::error::publish output is missing $f"; exit 1; }
          done
          ls "$W/_framework" | grep -q '\.wasm$' || { echo "::error::no .wasm in _framework"; exit 1; }
          echo "publish OK, $(du -sh "$W" | cut -f1)"

      - name: Snapshot the live directory
        run: |
          STAMP=$(date +%Y%m%d-%H%M%S)
          rsync -a "$WEB_ROOT/" "$BACKUPS/site-$STAMP/"
          echo "SNAPSHOT=$BACKUPS/site-$STAMP" >> "$GITHUB_ENV"
          ls -1dt "$BACKUPS"/site-* 2>/dev/null | tail -n +4 | xargs -r rm -rf || true

      - name: Sync
        run: rsync -a --delete "$GITHUB_WORKSPACE/publish/wwwroot/" "$WEB_ROOT/"

      - name: Verify what is being served, roll back on failure
        run: |
          served=$(curl -fsS "$PUBLIC_URL/build.json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('commit',''))" || true)
          code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/some/client/route")
          if [ "$served" != "$BUILD_COMMIT" ] || [ "$code" != "200" ]; then
            echo "::error::served build '$served' (expected '$BUILD_COMMIT'), fallback route answered $code - rolling back"
            rsync -a --delete "$SNAPSHOT/" "$WEB_ROOT/"
            exit 1
          fi
          echo "::notice::serving $served"