name: Deploy production

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy to production VM
    runs-on: vm-prod
    env:
      PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Preflight
        shell: bash
        run: |
          set -euo pipefail
          echo "Runner: $(hostname)"
          node --version
          npm --version
          pm2 --version
          rsync --version | head -n 1

      - name: Validate JavaScript
        shell: bash
        run: |
          set -euo pipefail
          node --check cron.js
          node --check src/app.js
          node --check src/controllers/processTicketLifecycleController.js
          node --check src/services/servicenowService.js
          node --check src/services/glpiTicketService.js

      - name: Deploy files and restart PM2
        shell: bash
        run: |
          set -euo pipefail

          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"

          mkdir -p "$DEPLOY_PATH"

          (
            flock -n 9 || {
              echo "Another deploy is already running."
              exit 1
            }

            rsync -az --delete \
              --exclude='.git/' \
              --exclude='.gitea/' \
              --exclude='.env*' \
              --exclude='node_modules/' \
              --exclude='logs/' \
              ./ "$DEPLOY_PATH"/

            cd "$DEPLOY_PATH"

            test -f .env.production || {
              echo "Missing $DEPLOY_PATH/.env.production"
              exit 1
            }

            grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
              echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
              exit 1
            }

            npm ci --omit=dev

            node --check cron.js
            node --check src/app.js
            node --check src/controllers/processTicketLifecycleController.js
            node --check src/services/servicenowService.js
            node --check src/services/glpiTicketService.js

            pm2 startOrRestart ecosystem.config.js --env production
            pm2 save
            pm2 list
          ) 9>"$LOCK_FILE"

      - name: Show sync logs
        if: always()
        shell: bash
        run: |
          pm2 logs sn-glpi-sync-cron --nostream --lines 80 || true