name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

# !!! Сгенерировано из ci-templates/deploy.template.yml скриптом sync-workflows.sh.
# !!! Правь ШАБЛОН и прогоняй sync, а не этот файл вручную.
#
# Раннер Gitea не умеет тянуть внешние uses:-actions (mkdir /.cache: permission
# denied), поэтому весь деплой — inline через SSH, без actions/checkout и т.п.
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      SERVICE: max-bot-test
      HEALTHCHECK: ""
      BUILD: "true"
      SERVER_HOST: ${{ vars.SERVER_HOST }}
      SERVER_PORT: ${{ vars.SERVER_PORT }}
      SERVER_USER: ${{ vars.SERVER_USER }}
      SERVER_BASE: ${{ vars.SERVER_BASE }}
      NTFY_URL: ${{ vars.NTFY_URL }}
    steps:
      - name: Setup SSH
        env:
          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "$SSH_KEY" | sed 's/^[[:space:]]*//' > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -p "$SERVER_PORT" "$SERVER_HOST" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Clone or reset repo on server
        run: |
          ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "
            set -e
            URL=https://git.pkirillw-server.ru/pkirillw/$SERVICE.git
            if [ -d '$SERVER_BASE/$SERVICE/.git' ]; then
              cd '$SERVER_BASE/$SERVICE'
              git rev-parse HEAD > /tmp/deploy_prev_$SERVICE
              git fetch origin main && git reset --hard origin/main
            elif [ -d '$SERVER_BASE/$SERVICE' ]; then
              # папка есть, но не git (развёрнуто вручную) — инициализируем на месте
              cd '$SERVER_BASE/$SERVICE'
              git init -q
              git remote add origin \$URL 2>/dev/null || git remote set-url origin \$URL
              git fetch -q origin main && git reset --hard origin/main
              : > /tmp/deploy_prev_$SERVICE
            else
              mkdir -p '$SERVER_BASE'
              cd '$SERVER_BASE' && git clone \$URL '$SERVICE'
              : > /tmp/deploy_prev_$SERVICE
            fi"


      - name: Deploy
        run: |
          if [ "$BUILD" = "true" ]; then CMD="docker compose up -d --build"; else CMD="docker compose pull && docker compose up -d"; fi
          ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "
            set -e
            cd '$SERVER_BASE/$SERVICE'
            $CMD
            docker image prune -f"

      - name: Health check
        if: ${{ env.HEALTHCHECK != '' }}
        run: |
          ok=""
          for i in $(seq 1 5); do
            if ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "curl -fsS -m 5 '$HEALTHCHECK' >/dev/null 2>&1"; then ok=1; break; fi
            sleep 5
          done
          [ -n "$ok" ] || { echo "::error::health-check не прошёл: $HEALTHCHECK"; exit 1; }

      - name: Rollback on failure
        if: failure()
        run: |
          ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "
            PREV=\$(cat /tmp/deploy_prev_$SERVICE 2>/dev/null || true)
            if [ -n \"\$PREV\" ]; then
              echo 'Откат на '\$PREV
              cd '$SERVER_BASE/$SERVICE' && git reset --hard \$PREV && docker compose up -d || true
            fi"

      - name: Notify ntfy
        if: always()
        run: |
          [ -n "$NTFY_URL" ] || exit 0
          if [ "${{ job.status }}" = "success" ]; then T="✅ $SERVICE задеплоен"; P=default; G=white_check_mark; else T="❌ $SERVICE: деплой упал"; P=high; G=rotating_light; fi
          curl -fsS -H "Title: $T" -H "Priority: $P" -H "Tags: $G" -d "commit ${{ github.sha }}" "$NTFY_URL" || true