name: Deploy production

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy to production VM
    runs-on: vm-prod
    env:
      PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Preflight
        shell: bash
        run: |
          set -euo pipefail
          echo "Runner: $(hostname)"
          node --version
          npm --version
          pm2 --version
          rsync --version | head -n 1

      - name: Check required secrets
        shell: bash
        run: |
          set -euo pipefail
          if [ -z "${{ secrets.ENV_PRODUCTION }}" ]; then
            echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
            exit 1
          fi

      - name: Validate JavaScript
        shell: bash
        run: |
          set -euo pipefail
          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check

      - name: Write .env.production from secret
        shell: bash
        run: |
          set -euo pipefail
          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          mkdir -p "$DEPLOY_PATH"
          printf '%s\n' "${{ secrets.ENV_PRODUCTION }}" > "$DEPLOY_PATH/.env.production"
          chmod 600 "$DEPLOY_PATH/.env.production"

      - name: Deploy files and restart PM2
        shell: bash
        run: |
          set -euo pipefail

          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"

          mkdir -p "$DEPLOY_PATH"

          (
            flock -n 9 || {
              echo "Another deploy is already running."
              exit 1
            }

            if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
              rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
            fi

            rsync -az --delete \
              --exclude='.git/' \
              --exclude='.gitea/' \
              --exclude='.env*' \
              --exclude='node_modules/' \
              --exclude='logs/' \
              ./ "$DEPLOY_PATH"/

            cd "$DEPLOY_PATH"

            test -f .env.production || {
              echo "Missing $DEPLOY_PATH/.env.production"
              exit 1
            }

            grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
              echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
              exit 1
            }

            npm ci --omit=dev

            find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check

            pm2 startOrRestart ecosystem.config.js --env production
            pm2 save
            pm2 list
          ) 9>"$LOCK_FILE"

      - name: Show sync logs
        if: always()
        shell: bash
        run: |
          pm2 logs sn-glpi-sync-cron --nostream --lines 80 || true