on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: docker
    container:
      image: node:24-bookworm
    timeout-minutes: 30
    steps:
      - name: Install deploy tools
        run: |
          set -eu
          apt-get update -qq
          apt-get install -y -q ca-certificates curl git jq

      - name: Build Astro and restart Nomad
        env:
          NOMAD_ADDR: ${{ secrets.NOMAD_ADDR }}
          NOMAD_TOKEN: ${{ secrets.NOMAD_TOKEN }}
          PUBLIC_ANALYTICS_DASHBOARD_URL: ${{ secrets.PUBLIC_ANALYTICS_DASHBOARD_URL }}
          PUBLIC_CONTACT_FORM_ENDPOINT: ${{ secrets.PUBLIC_CONTACT_FORM_ENDPOINT }}
          PUBLIC_CONTACT_RECIPIENTS: ${{ secrets.PUBLIC_CONTACT_RECIPIENTS }}
          PUBLIC_CONTACT_SUBMISSIONS_URL: ${{ secrets.PUBLIC_CONTACT_SUBMISSIONS_URL }}
          PUBLIC_PLAUSIBLE_DOMAIN: ${{ secrets.PUBLIC_PLAUSIBLE_DOMAIN }}
          PUBLIC_PLAUSIBLE_SCRIPT_SRC: ${{ secrets.PUBLIC_PLAUSIBLE_SCRIPT_SRC }}
          NODE_OPTIONS: --max-old-space-size=768
          REPO_URL: https://git.bcgen.ie/familyfedie/familyfedie-website.git
        run: |
          set -eu
          export REF_NAME="${GITHUB_REF_NAME:-main}"

          git config --global http.lowSpeedLimit 1024
          git config --global http.lowSpeedTime 60

          for attempt in 1 2 3; do
            echo "Cloning $REPO_URL ($REF_NAME), attempt $attempt/3"
            rm -rf source
            if timeout 180 git clone --depth 1 --branch "$REF_NAME" "$REPO_URL" source; then
              break
            fi
            if [ "$attempt" -eq 3 ]; then
              echo "git clone failed after 3 attempts" >&2
              exit 1
            fi
            sleep $((attempt * 10))
          done

          cd source
          npm config set fetch-retries 4
          npm config set fetch-retry-mintimeout 10000
          npm config set fetch-retry-maxtimeout 60000
          npm config set fetch-timeout 300000

          echo "Installing npm dependencies..."
          timeout 600 npm ci --no-audit --no-fund
          rm -rf dist
          echo "Building Astro site..."
          timeout 600 npm run build

          test -f dist/index.html
          test -f dist/admin/index.html
          test -f dist/speeches/index.html
          test -f dist/assets/icons/familyfed-favicon.png

          export DEPLOY_MANIFEST="$(
            cd dist
            find . -type f -print0 \
              | LC_ALL=C sort -z \
              | xargs -0 sha256sum \
              | sha256sum \
              | awk '{print $1}'
          )"

          export DEPLOY_COMMIT="${GITHUB_SHA:-$(git rev-parse HEAD)}"
          echo "Registering Nomad deployment for $DEPLOY_COMMIT ($DEPLOY_MANIFEST)"
          curl -fsS \
            --connect-timeout 15 \
            --max-time 60 \
            --retry 3 \
            --retry-delay 5 \
            --retry-all-errors \
            -H "X-Nomad-Token: $NOMAD_TOKEN" \
            "$NOMAD_ADDR/v1/job/familyfed" \
            | jq '
                (.TaskGroups[].Tasks[].Env //= {})
                | .TaskGroups[].Tasks[].Env.DEPLOY_COMMIT = env.DEPLOY_COMMIT
                | ((.TaskGroups[].Tasks[] | select(.Name == "build-site") | .Config.args[]) |=
                    (sub("/archive/[0-9a-f]{40}\\.tar\\.gz";
                         "/archive/" + env.DEPLOY_COMMIT + ".tar.gz")
                     | sub("test \"\\$actual_manifest\" = \"[0-9a-f]{64}\""; ":")))
                | (.TaskGroups[].Tasks[].Artifacts[]?.GetterSource |=
                    if startswith("git::") and test("[?&]ref=") then
                      sub("ref=[^&]*"; "ref=" + env.DEPLOY_COMMIT)
                    elif startswith("git::") then
                      . + (if contains("?") then "&" else "?" end) + "ref=" + env.DEPLOY_COMMIT
                    else . end)
                | {Job: .}
              ' \
            > /tmp/familyfed-job.json

          curl -fsS -X POST \
            --connect-timeout 15 \
            --max-time 60 \
            --retry 3 \
            --retry-delay 5 \
            --retry-all-errors \
            -H "Content-Type: application/json" \
            -H "X-Nomad-Token: $NOMAD_TOKEN" \
            --data-binary @/tmp/familyfed-job.json \
            "$NOMAD_ADDR/v1/jobs"
          echo "Deploy registered. Nomad will replace the allocation and re-fetch the site."