name: Deploy TodoList

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Verify runner prerequisites
        shell: bash
        run: |
          set -Eeuo pipefail
          command -v bash >/dev/null
          command -v ssh >/dev/null
          command -v base64 >/dev/null

      - name: Deploy production
        shell: bash
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_B64 }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          set -Eeuo pipefail
          umask 077

          test -n "$DEPLOY_HOST"
          test -n "$DEPLOY_PORT"
          test -n "$DEPLOY_USER"
          test -n "$DEPLOY_SSH_KEY_B64"
          test -n "$DEPLOY_KNOWN_HOSTS"

          SSH_DIR="$(mktemp -d)"
          trap 'rm -rf -- "$SSH_DIR"' EXIT HUP INT TERM

          printf '%s' "$DEPLOY_SSH_KEY_B64" |
            base64 --decode > "$SSH_DIR/id_ed25519"

          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" \
            > "$SSH_DIR/known_hosts"

          chmod 600 "$SSH_DIR/id_ed25519"
          chmod 600 "$SSH_DIR/known_hosts"

          ssh \
            -p "$DEPLOY_PORT" \
            -i "$SSH_DIR/id_ed25519" \
            -o BatchMode=yes \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile="$SSH_DIR/known_hosts" \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            /home/scaiuser/dwh_apps/fastapi-todolist/scripts/ci-deploy-entrypoint.sh