name: Deploy production

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy to production VM
    runs-on: vm-prod
    env:
      PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Preflight
        shell: bash
        run: |
          set -euo pipefail
          echo "Runner: $(hostname)"
          node --version
          npm --version
          pm2 --version
          rsync --version | head -n 1 || true

      - name: Check required secrets
        shell: bash
        env:
          ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
        run: |
          set -euo pipefail
          if [ -z "${ENV_PRODUCTION:-}" ]; then
            echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
            exit 1
          fi

      - name: Validate JavaScript
        shell: bash
        run: |
          set -euo pipefail
          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check

      - name: Write .env.production from secret
        shell: bash
        env:
          ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
        run: |
          set -euo pipefail
          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          mkdir -p "$DEPLOY_PATH"
          printf '%s\n' "$ENV_PRODUCTION" > "$DEPLOY_PATH/.env.production"
          chmod 600 "$DEPLOY_PATH/.env.production"
          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH/.env.production"

      - name: Deploy files and restart PM2
        shell: bash
        run: |
          set -euo pipefail

          # O checkout do runner (~/.cache/act/.../hostexecutor) so e legivel pelo root - o
          # 'desenvolvimento' nem consegue entrar la. Por isso o rsync (que le de la e escreve em
          # $DEPLOY_PATH) roda como root, igual sempre rodou. So DEPOIS de copiado a posse passa
          # pro 'desenvolvimento' (chown), e dali em diante (npm ci, node --check, pm2) roda como
          # 'desenvolvimento' via sudo -u - sem mudar o usuario do runner nem mexer em /opt em si
          # (evita afetar outras automacoes deste servidor).
          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
          POST_SCRIPT="/tmp/sn-glpi-sync-new.deploy-post.sh"

          mkdir -p "$DEPLOY_PATH"
          mkdir -p "$DEPLOY_PATH.previous"
          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH.previous"

          cat > "$POST_SCRIPT" <<'POST_EOF'
          #!/usr/bin/env bash
          set -euo pipefail
          cd "$DEPLOY_PATH"
          npm ci --omit=dev
          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
          pm2 startOrRestart ecosystem.config.js --env production
          pm2 save
          pm2 list
          POST_EOF
          chmod +x "$POST_SCRIPT"

          (
            flock -n 9 || {
              echo "Another deploy is already running."
              exit 1
            }

            if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
              rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
            fi

            rsync -az --delete \
              --exclude='.git/' \
              --exclude='.gitea/' \
              --exclude='.env*' \
              --exclude='node_modules/' \
              --exclude='logs/' \
              ./ "$DEPLOY_PATH"/

            chown -R desenvolvimento:desenvolvimento "$DEPLOY_PATH"

            cd "$DEPLOY_PATH"

            test -f .env.production || {
              echo "Missing $DEPLOY_PATH/.env.production"
              exit 1
            }

            grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
              echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
              exit 1
            }

            sudo -u desenvolvimento -H DEPLOY_PATH="$DEPLOY_PATH" bash "$POST_SCRIPT"
          ) 9>"$LOCK_FILE"

          rm -f "$POST_SCRIPT"

      - name: Show sync logs
        if: always()
        shell: bash
        run: |
          pm2 logs sn-glpi-sync-cron --nostream --lines 80 || true