name: Veyra CI/CD
on:
  push:
    branches: [master]
env:
  REMOTE_DIR: /home/workspace/sundynix-veyra
  DEPLOY_HOST: 192.168.100.132
  DEPLOY_USER: root
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout exact commit from Gitea
        env:
          GITEA_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          archive_path="$(mktemp)"
          trap 'rm -f "$archive_path"' EXIT
          archive_ready=false
          for attempt in 1 2 3 4 5; do
            if curl -fLsS --connect-timeout 10 --max-time 180 --retry 2 --retry-all-errors \
              -H "Authorization: token ${GITEA_TOKEN}" \
              "https://git.sundynix.cn/${REPOSITORY}/archive/${COMMIT_SHA}.tar.gz" \
              -o "$archive_path" && tar -tzf "$archive_path" >/dev/null 2>&1; then
              archive_ready=true
              break
            fi
            sleep "$attempt"
          done
          test "$archive_ready" = true
          tar -xzf "$archive_path" --strip-components=1
      - name: Install SSH tools
        run: |
          set -eu
          if command -v sshpass >/dev/null && command -v ssh >/dev/null; then exit 0; fi
          if command -v apk >/dev/null; then
            apk add --no-cache sshpass openssh-client
          else
            apt-get update -qq
            apt-get install -y -qq --no-install-recommends sshpass openssh-client
          fi
      - name: Verify and build on cached deployment host
        env:
          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          COMMIT_SHA: ${{ github.sha }}
        run: bash deploy/ci-ssh.sh verify
  deploy:
    needs: verify
    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout exact commit from Gitea
        env:
          GITEA_TOKEN: ${{ github.token }}
          REPOSITORY: ${{ github.repository }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          archive_path="$(mktemp)"
          trap 'rm -f "$archive_path"' EXIT
          archive_ready=false
          for attempt in 1 2 3 4 5; do
            if curl -fLsS --connect-timeout 10 --max-time 180 --retry 2 --retry-all-errors \
              -H "Authorization: token ${GITEA_TOKEN}" \
              "https://git.sundynix.cn/${REPOSITORY}/archive/${COMMIT_SHA}.tar.gz" \
              -o "$archive_path" && tar -tzf "$archive_path" >/dev/null 2>&1; then
              archive_ready=true
              break
            fi
            sleep "$attempt"
          done
          test "$archive_ready" = true
          tar -xzf "$archive_path" --strip-components=1
      - name: Install SSH tools
        run: |
          set -eu
          if command -v sshpass >/dev/null && command -v ssh >/dev/null; then exit 0; fi
          if command -v apk >/dev/null; then
            apk add --no-cache sshpass openssh-client
          else
            apt-get update -qq
            apt-get install -y -qq --no-install-recommends sshpass openssh-client
          fi
      - name: Deploy verified image
        env:
          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          COMMIT_SHA: ${{ github.sha }}
        run: bash deploy/ci-ssh.sh deploy