name: Deploy Prod

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy para VM Prod
    runs-on: self-hosted-prod
    env:
      DEPLOY_PATH: /opt/omnichannel

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Preflight
        shell: bash
        run: |
          set -euo pipefail
          echo "Runner: $(hostname)"
          docker --version
          docker compose version
          psql --version

      - name: Verificar secrets obrigatórios
        shell: bash
        env:
          DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
        run: |
          set -euo pipefail
          if [ -z "${DB_PASSWORD:-}" ]; then
            echo "Secret PROD_DB_PASSWORD não configurado."
            exit 1
          fi

      - name: Sync arquivos para o servidor
        shell: bash
        run: |
          set -euo pipefail
          rsync -az --delete \
            --exclude='.git/' \
            --exclude='.gitea/' \
            --exclude='frontend/' \
            --exclude='backend/' \
            --exclude='uploads/' \
            ./ "$DEPLOY_PATH"/

      - name: Executar migrations
        shell: bash
        env:
          PGPASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
        run: |
          set -euo pipefail
          for f in $(ls "$DEPLOY_PATH/database/migrations/"*.sql | sort); do
            echo "Aplicando: $(basename "$f")"
            psql \
              -h ${{ secrets.PROD_DB_HOST }} \
              -p ${{ secrets.PROD_DB_PORT }} \
              -U ${{ secrets.PROD_DB_USER }} \
              -d ${{ secrets.PROD_DB_NAME }} \
              -f "$f"
          done