name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Set image tag
        id: meta
        run: echo "tag=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Login to Yandex Container Registry
        uses: yc-actions/yc-cr-login@v3
        with:
          yc-sa-json-credentials: ${{ secrets.YC_SA_JSON_CREDENTIALS }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build & push backend
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          push: true
          cache-from: type=gha,scope=backend
          cache-to: type=gha,mode=max,scope=backend
          tags: |
            cr.yandex/${{ secrets.YC_REGISTRY_ID }}/backend:latest
            cr.yandex/${{ secrets.YC_REGISTRY_ID }}/backend:${{ steps.meta.outputs.tag }}

      - name: Build & push frontend
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          push: true
          cache-from: type=gha,scope=frontend
          cache-to: type=gha,mode=max,scope=frontend
          tags: |
            cr.yandex/${{ secrets.YC_REGISTRY_ID }}/frontend:latest
            cr.yandex/${{ secrets.YC_REGISTRY_ID }}/frontend:${{ steps.meta.outputs.tag }}

      - name: Deploy to VM via SSH
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_PORT || 22 }}
          script: |
            set -euo pipefail
            cd /opt/gendesign

            # Login to YCR on the host (uses key passed via env or pre-configured docker config)
            echo "${{ secrets.YC_SA_JSON_CREDENTIALS }}" | docker login \
              --username json_key \
              --password-stdin cr.yandex

            export IMAGE_TAG=${{ steps.meta.outputs.tag }}
            docker compose -f docker-compose.prod.yml pull
            docker compose -f docker-compose.prod.yml up -d
            docker image prune -f

            # Wait for health
            sleep 5
            curl -fsS http://localhost:8000/health | head -c 200