name: Build & Deploy

on:
  push

env:
  REGISTRY: git.aggtaa.com
  IMAGE_PREFIX: ${{ gitea.repository }}

jobs:
  # ── BUILD SERVER ──────────────────────────────────────────────────────────────
  build-server:
    runs-on: docker1
    steps:
      - name: Install Docker CLI
        run: |
          apk add --no-cache docker-cli
          mkdir -p ~/.docker/cli-plugins
          wget -qO ~/.docker/cli-plugins/docker-buildx \
            https://github.com/docker/buildx/releases/download/v0.15.1/buildx-v0.15.1.linux-amd64
          chmod +x ~/.docker/cli-plugins/docker-buildx

      - name: Checkout
        run: |
          if [ -d .git ]; then
            git fetch origin main
            git reset --hard origin/main
          else
            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git .
          fi

      - name: Build & push server
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
            docker login ${{ env.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin

          docker buildx build \
            --cache-from type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/server:cache \
            --cache-to   type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/server:cache,mode=max \
            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/server:latest \
            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/server:${{ gitea.sha }} \
            --file server.Dockerfile \
            --push \
            .

  # ── BUILD WEBCLIENT ───────────────────────────────────────────────────────────
  build-webclient:
    runs-on: docker1
    steps:
      - name: Checkout
        run: |
          if [ -d .git ]; then
            git fetch origin main
            git reset --hard origin/main
          else
            git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git .
          fi

      - name: Build & push webclient
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
            docker login ${{ env.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin

          docker buildx build \
            --cache-from type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/webclient:cache \
            --cache-to   type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/webclient:cache,mode=max \
            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/webclient:latest \
            --tag ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/webclient:${{ gitea.sha }} \
            --file webclient.Dockerfile \
            --push \
            .

  # ── DEPLOY ────────────────────────────────────────────────────────────────────
  deploy:
    runs-on: docker1
    needs: [build-server, build-webclient]
    if: always() && !failure() && !cancelled()
    steps:
      - name: Deploy via SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts

          ssh -i ~/.ssh/deploy_key ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} bash << 'EOF'
            set -e
            mkdir -p /opt/blockly3d
            cd /opt/blockly3d
            if [ ! -d .git ]; then
              git clone https://git.aggtaa.com/anton/blockly3d.git .
            else
              git pull origin main
            fi
            docker compose pull
            docker compose up -d --remove-orphans
            docker image prune -f
          EOF