name: Deploy production

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  deploy:
    name: Deploy to production VM
    runs-on: vm-prod
    env:
      PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Preflight
        shell: bash
        run: |
          set -euo pipefail
          echo "Runner: $(hostname)"
          node --version
          npm --version
          pm2 --version
          rsync --version | head -n 1 || true

      - name: Check required secrets
        shell: bash
        env:
          ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
        run: |
          set -euo pipefail
          if [ -z "${ENV_PRODUCTION:-}" ]; then
            echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
            exit 1
          fi

      - name: Validate JavaScript
        shell: bash
        run: |
          set -euo pipefail
          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check

      - name: Write .env.production from secret
        shell: bash
        env:
          ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
        run: |
          set -euo pipefail
          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          mkdir -p "$DEPLOY_PATH"
          printf '%s\n' "$ENV_PRODUCTION" > "$DEPLOY_PATH/.env.production"
          chmod 600 "$DEPLOY_PATH/.env.production"
          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH/.env.production"

      - name: Deploy files and restart PM2
        shell: bash
        run: |
          set -euo pipefail

          # O runner roda como root (compartilhado com outras automacoes deste servidor), mas o
          # app deve rodar como 'desenvolvimento' - e o dono do PM2/logs/.env.production hoje.
          # Em vez de mudar o usuario do runner (afetaria outras automacoes), so essa etapa troca
          # de usuario via sudo -u, escrevendo o script num arquivo temporario pra evitar qualquer
          # ambiguidade de escaping de aspas dentro do 'run:' do workflow.
          DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
          LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
          DEPLOY_SCRIPT="/tmp/sn-glpi-sync-new.deploy.sh"

          mkdir -p "$DEPLOY_PATH"

          # "$DEPLOY_PATH.previous" e uma pasta nova, irma de $DEPLOY_PATH, direto dentro de /opt -
          # o 'desenvolvimento' nao tem permissao de criar entradas novas ali (nem deveria, /opt e
          # compartilhado com outras automacoes). O root pre-cria e ja entrega a posse antes de
          # trocar de usuario, sem precisar abrir permissao de /opt em si.
          mkdir -p "$DEPLOY_PATH.previous"
          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH.previous"

          cat > "$DEPLOY_SCRIPT" <<'DEPLOY_EOF'
          #!/usr/bin/env bash
          set -euo pipefail

          if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
            rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
          fi

          rsync -az --delete \
            --exclude='.git/' \
            --exclude='.gitea/' \
            --exclude='.env*' \
            --exclude='node_modules/' \
            --exclude='logs/' \
            "$SRC_DIR"/ "$DEPLOY_PATH"/

          cd "$DEPLOY_PATH"

          test -f .env.production || {
            echo "Missing $DEPLOY_PATH/.env.production"
            exit 1
          }

          grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
            echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
            exit 1
          }

          npm ci --omit=dev

          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check

          pm2 startOrRestart ecosystem.config.js --env production
          pm2 save
          pm2 list
          DEPLOY_EOF
          chmod +x "$DEPLOY_SCRIPT"

          (
            flock -n 9 || {
              echo "Another deploy is already running."
              exit 1
            }
            sudo -u desenvolvimento -H DEPLOY_PATH="$DEPLOY_PATH" SRC_DIR="$PWD" bash "$DEPLOY_SCRIPT"
          ) 9>"$LOCK_FILE"

          rm -f "$DEPLOY_SCRIPT"

      - name: Show sync logs
        if: always()
        shell: bash
        run: |
          pm2 logs sn-glpi-sync-cron --nostream --lines 80 || true