name: Gateway

# Every push touching the gateway: typecheck and tests. On main, also build the image, push it to
# the Gitea registry tagged with the commit and `latest`, and ask junior.gib (the VPS) to deploy it
# now. Its nightly update-containers timer is the fallback when the deploy trigger fails.
#
# Uses the user-level secrets REGISTRY_USER and REGISTRY_PASSWORD, and the repo secret
# DEPLOY_SSH_KEY_VPS_B64, a base64 encoded key that junior.gib only accepts for
# ~/Server/ci-deploy.sh.

on:
  push:
    paths:
      - 'gateway/**'
      - '.gitea/workflows/gateway.yml'
  pull_request:
    paths:
      - 'gateway/**'

concurrency:
  group: gateway-${{ gitea.ref }}
  cancel-in-progress: true

jobs:
  check:
    runs-on: build
    steps:
      - name: Checkout
        # Plain git instead of actions/checkout: rootless podman on some runners rejects symlinks
        # inside cached actions.
        env:
          GITEA_TOKEN: ${{ gitea.token }}
        run: |
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
          git -c http.extraHeader="Authorization: basic $auth" \
            fetch -q --depth 1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD

      - name: Set up Bun
        # The install script instead of oven-sh/setup-bun, for the same symlink reason.
        run: |
          curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.0" >/dev/null
          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"

      - name: Typecheck and test
        working-directory: gateway
        run: |
          bun install --frozen-lockfile
          bun run typecheck
          bun test

  image:
    needs: [check]
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    runs-on: build
    env:
      IMAGE: git.gbrown.org/gib/wristcode-gateway
    steps:
      - name: Checkout
        env:
          GITEA_TOKEN: ${{ gitea.token }}
        run: |
          git init -q .
          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
          git -c http.extraHeader="Authorization: basic $auth" \
            fetch -q --depth 1 origin "${{ gitea.sha }}"
          git checkout -q FETCH_HEAD

      - name: Build
        run: docker build -f gateway/Containerfile -t "$IMAGE:${{ gitea.sha }}" -t "$IMAGE:latest" gateway

      - name: Push
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
          docker push "$IMAGE:${{ gitea.sha }}"
          docker push "$IMAGE:latest"

      - name: Deploy
        # 192.168.2.2 is junior's WireGuard address, reachable from every runner. The secret is the
        # private key base64 encoded on one line. The runner prints each step's
        # env, and Gitea only masks a secret it can match in full, which a multi-line key defeats.
        env:
          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_VPS_B64 }}
        run: |
          install -m600 /dev/null "$HOME/.deploy_key"
          printf '%s' "$DEPLOY_SSH_KEY_B64" | base64 -d > "$HOME/.deploy_key"
          ssh -i "$HOME/.deploy_key" \
              -o BatchMode=yes \
              -o StrictHostKeyChecking=accept-new \
              -o ConnectTimeout=15 \
              gib@192.168.2.2 wristcode \
            || echo "::warning::deploy trigger failed; the nightly update timer will deploy instead"
          rm -f "$HOME/.deploy_key"