name: Deploy backoffice (smb-crm)

# Manual only, on purpose: this runner has docker-compose access on the
# homelab host, so triggering it is equivalent to a deploy. Only Gitea users
# with write access to this repo can see/press the "Run workflow" button —
# that's the access boundary, so keep collaborator roles deliberate as more
# people join (see TODO.md).
on:
  workflow_dispatch:
    inputs:
      ref:
        description: "Branch/tag/commit to deploy"
        required: false
        default: "main"

jobs:
  deploy:
    runs-on: [self-hosted, homelab]
    steps:
      # Plain git clone instead of actions/checkout@v4: that action is
      # Node.js-based, and this runner deliberately has no Node toolchain
      # (host-mode jobs run directly on the homelab, kept minimal). Auth is
      # via the DEPLOY_TOKEN Actions secret (repo is private); the token is
      # stripped from the stored remote URL right after cloning.
      - name: Checkout
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
          DEPLOY_REF: ${{ inputs.ref }}
        run: |
          set -euo pipefail
          find . -mindepth 1 -delete
          # inputs.ref comes through fully-qualified (refs/heads/main), not "main"
          BRANCH="${DEPLOY_REF#refs/heads/}"
          git clone --depth 1 --branch "$BRANCH" \
            "http://${DEPLOY_TOKEN}@172.24.0.2:3000/BPPP/smb-online.git" .
          git remote set-url origin http://172.24.0.2:3000/BPPP/smb-online.git

      # Only db/ and app/ — never touch secrets/ or .env, which live only on
      # the host and aren't in the repo.
      - name: Sync backoffice files
        run: |
          set -euo pipefail
          rsync -a --delete backoffice/db/  /home/mivanchenko/smb-crm/db/
          rsync -a --delete backoffice/app/ /home/mivanchenko/smb-crm/app/

      # init.sql is all CREATE ... IF NOT EXISTS, so re-running it against the
      # live DB on every deploy is safe and needs no separate migration tool.
      - name: Apply pending schema changes
        run: docker exec -i smb-db psql -U smbcrm -d smbcrm < backoffice/db/init.sql

      - name: Build and restart smb-crm
        run: |
          cd /home/mivanchenko/smb-crm
          docker compose build smb-crm
          docker compose up -d --no-deps smb-crm

      - name: Health check
        run: |
          set -euo pipefail
          for i in $(seq 1 10); do
            if docker exec smb-crm python3 -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8080/healthz').status==200 else 1)"; then
              echo "smb-crm healthy"
              exit 0
            fi
            sleep 2
          done
          echo "smb-crm failed health check after deploy" >&2
          exit 1