name: CI/CD

on:
  push:
    branches: ['**']
  pull_request:
    branches: ['**']

concurrency:
  group: production-deploy
  cancel-in-progress: false

jobs:
  backend-tests:
    name: BackEnd
    runs-on: ubuntu-latest
    timeout-minutes: 20
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore Musify.slnx

      - name: Build
        run: dotnet build Musify.slnx --no-restore -c Release

      - name: Test
        run: dotnet test Musify.slnx --no-build -c Release

  web-player-checks:
    name: WebPlayer
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: web-player
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: web-player/package-lock.json

      - run: npm ci

      - name: Type-check
        run: npm run check

      - name: Lint
        run: npm run lint

  # Runs on the production host itself, through the existing self-hosted
  # Gitea Actions runner (act_runner), which also carries a "production"
  # label registered in native (non-docker) mode so its steps see the host's
  # real Docker daemon directly (Docker socket + a bind-mounted deploy
  # directory — see deploy/README.md for how that runner is set up).
  #
  # DEPLOY_PATH is the persistent clone already on that host (the one whose
  # deploy/.env.prod is filled in and matches SharedServices/.env.prod) —
  # deploy reuses it instead of a fresh checkout, since .env.prod is
  # untracked and only lives there.
  deploy:
    name: Deploy
    needs: [backend-tests, web-player-checks]
    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
    runs-on: [production]
    timeout-minutes: 20
    env:
      DEPLOY_PATH: /home/ubuntu/deploys/musify
      COMPOSE: docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml
    steps:
      - name: Pull latest master
        run: |
          set -euo pipefail
          git config --global --add safe.directory "$DEPLOY_PATH"
          cd "$DEPLOY_PATH"
          git fetch origin master
          git reset --hard origin/master

      - name: Generate stream-ticket keys
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          $COMPOSE run --rm --no-deps keys-init

      # The migrations are baked into the migrator image, so it is rebuilt on
      # every deploy (plain `up` would reuse the stale image and re-apply the
      # old migrations). `run --rm` starts wait-for-postgres, blocks until the
      # migration finishes and propagates its exit code, so a failed migration
      # aborts the deploy before the new API is started against an old schema.
      - name: Migrate database
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          $COMPOSE build migrate
          $COMPOSE run --rm migrate

      # Both jobs verify themselves through the public auth./s3. URLs, served
      # by the shared edge nginx (Infrastructure's edge/), and are idempotent.
      - name: Create OIDC app and S3 bucket
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          $COMPOSE up -d seaweedfs-init zitadel-init
          for job in musify-seaweedfs-init musify-zitadel-init; do
            code=$(docker wait "$job")
            if [ "$code" != "0" ]; then
              docker logs "$job"
              echo "$job exited with $code"
              exit 1
            fi
          done

      - name: Build and start apps
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          $COMPOSE --profile apps up -d --build api worker gateway web-player