name: CI/CD

on:
  push:
    branches: ['**']
  pull_request:
    branches: ['**']

concurrency:
  group: production-deploy
  cancel-in-progress: false

jobs:
  backend-tests:
    name: BackEnd
    runs-on: ubuntu-latest
    timeout-minutes: 20
    defaults:
      run:
        working-directory: backend
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore Musify.slnx

      - name: Build
        run: dotnet build Musify.slnx --no-restore -c Release

      - name: Test
        run: dotnet test Musify.slnx --no-build -c Release

  web-player-checks:
    name: WebPlayer
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: web-player
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: web-player/package-lock.json

      - run: npm ci

      - name: Type-check
        run: npm run check

      - name: Lint
        run: npm run lint

  # Runs on the production host itself, through the existing self-hosted
  # Gitea Actions runner (act_runner), which also carries a "production"
  # label registered in native (non-docker) mode so its steps see the host's
  # real Docker daemon directly (Docker socket + a bind-mounted deploy
  # directory — see deploy/README.md for how that runner is set up).
  #
  # DEPLOY_PATH is the persistent clone already on that host (the one whose
  # deploy/.env.prod is filled in and matches SharedServices/.env.prod) —
  # deploy reuses it instead of a fresh checkout, since .env.prod is
  # untracked and only lives there.
  deploy:
    name: Deploy
    needs: [backend-tests, web-player-checks]
    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
    runs-on: [production]
    timeout-minutes: 20
    env:
      DEPLOY_PATH: /home/ubuntu/deploys/musify
      COMPOSE: docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml
    steps:
      - name: Pull latest master
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          git fetch origin master
          git reset --hard origin/master

      - name: Migrate database, generate keys
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          $COMPOSE up -d wait-for-postgres keys-init migrate

      # zitadel-init/seaweedfs-init verify themselves through the PUBLIC
      # auth./s3. URLs (see deploy/compose.yml), so they only succeed once a
      # real domain is registered and nginx is serving it (see the TODO
      # below and deploy/README.md). Tolerated for now so a red step here
      # doesn't block the rest of the deploy; drop the `|| true` once that's
      # in place, so a real regression here fails the job again.
      - name: Create OIDC app and S3 bucket
        run: |
          cd "$DEPLOY_PATH"
          $COMPOSE up -d seaweedfs-init zitadel-init || echo "expected to fail until the production domain + nginx edge exist"

      - name: Build and start apps
        run: |
          set -euo pipefail
          cd "$DEPLOY_PATH"
          $COMPOSE --profile apps up -d --build api worker gateway web-player

      # TODO once a domain is registered and pointed at this server: merge
      # Musify's vhosts (deploy/nginx/templates) into the existing
      # gitea-nginx config instead of running the `nginx` service from
      # compose.prod.yml, since gitea-nginx already owns host ports 80/443
      # for gitea.ikerdemo.cat. See "Continuous deployment" in
      # deploy/README.md.