name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  DEPLOY_HOST: "10.10.1.82"
  APP_PORT: "3010"
  DEPLOY_PATH: "/var/www/hrm"

jobs:
  build:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    container:
      image: oven/bun:1
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build
        env:
          PORT: ${{ env.APP_PORT }}
          VITE_POCKETBASE_URL: ${{ vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}

  deploy:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    container:
      image: node:20-bookworm
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install curl and ca-certificates
        run: apt-get update -qq && apt-get install -y curl ca-certificates

      - name: Install Bun
        run: |
          curl -fsSL https://bun.sh/install | bash
          echo "$HOME/.bun/bin" >> $GITHUB_PATH
          echo "PATH=$HOME/.bun/bin:$PATH" >> $GITHUB_ENV

      - name: Install deploy tools
        run: apt-get update -qq && apt-get install -y rsync openssh-client sshpass

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build
        env:
          PORT: ${{ env.APP_PORT }}
          VITE_POCKETBASE_URL: ${{ secrets.VITE_POCKETBASE_URL || vars.VITE_POCKETBASE_URL || 'https://pocketbase.ccllc.pro' }}

      - name: Prepare deploy artifact
        run: |
          ls -la
          test -d build || (echo "Missing build/ (SvelteKit output). Check Build step." && exit 1)
          mkdir -p deploy
          cp -r build package.json deploy/
          (test -f bun.lock && cp bun.lock deploy/) || (test -f bun.lockb && cp bun.lockb deploy/) || true
          cd deploy && bun install --frozen-lockfile --production

      - name: Setup SSH known hosts
        run: |
          mkdir -p ~/.ssh
          ssh-keyscan -p ${{ secrets.DEPLOY_SSH_PORT || '22' }} -H ${{ secrets.DEPLOY_HOST || env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Deploy via rsync
        env:
          SSH_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
        run: |
          sshpass -p "$SSH_PASSWORD" rsync -avz --delete \
            -e "ssh -o StrictHostKeyChecking=accept-new -p ${{ secrets.DEPLOY_SSH_PORT || '22' }}" \
            deploy/ \
            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST || env.DEPLOY_HOST }}:${{ secrets.DEPLOY_PATH || env.DEPLOY_PATH }}/

      - name: Restart app on server
        env:
          SSH_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
        run: |
          sshpass -p "$SSH_PASSWORD" ssh -o StrictHostKeyChecking=accept-new -p ${{ secrets.DEPLOY_SSH_PORT || '22' }} \
            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST || env.DEPLOY_HOST }} \
            'bash -lc "cd ${{ secrets.DEPLOY_PATH || env.DEPLOY_PATH }} && export PORT=${{ env.APP_PORT }} && (pm2 restart hrm 2>/dev/null || pm2 start build/index.js --name hrm --update-env)"'