name: Build and publish static site

on:
  push:
  workflow_dispatch:

concurrency:
  group: site-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: docker
    container:
      image: node:24-bookworm
    timeout-minutes: 30
    env:
      NODE_OPTIONS: --max-old-space-size=768
      PUBLIC_ANALYTICS_DASHBOARD_URL: ${{ secrets.PUBLIC_ANALYTICS_DASHBOARD_URL }}
      PUBLIC_CONTACT_FORM_ENDPOINT: ${{ secrets.PUBLIC_CONTACT_FORM_ENDPOINT }}
      PUBLIC_CONTACT_RECIPIENTS: ${{ secrets.PUBLIC_CONTACT_RECIPIENTS }}
      PUBLIC_CONTACT_SUBMISSIONS_URL: ${{ secrets.PUBLIC_CONTACT_SUBMISSIONS_URL }}
      PUBLIC_PLAUSIBLE_DOMAIN: ${{ secrets.PUBLIC_PLAUSIBLE_DOMAIN }}
      PUBLIC_PLAUSIBLE_SCRIPT_SRC: ${{ secrets.PUBLIC_PLAUSIBLE_SCRIPT_SRC }}
    steps:
      - uses: actions/checkout@v4

      - name: Install validation tools
        run: |
          apt-get update -qq
          apt-get install -y -q python3

      - name: Install dependencies
        run: npm ci --no-audit --no-fund

      - name: Build and validate Astro output
        run: npm run check

      - name: Split public and protected admin bundles
        run: |
          set -eu
          rm -rf bundle-public bundle-admin
          mkdir -p bundle-public bundle-admin/admin bundle-admin/css
          cp -a dist/. bundle-public/
          rm -rf bundle-public/admin bundle-public/admin.html
          test ! -e bundle-public/admin
          test ! -e bundle-public/admin.html

          cp dist/admin/index.html bundle-admin/index.html
          cp dist/admin/index.html bundle-admin/admin/index.html
          cp -a dist/admin/content bundle-admin/admin/content
          cp dist/css/admin.css bundle-admin/css/admin.css

      - name: Install Garage publishing tools
        if: github.ref == 'refs/heads/main'
        run: |
          set -eu
          apt-get update -qq
          apt-get install -y -q ca-certificates python3-venv
          python3 -m venv /opt/awscli
          /opt/awscli/bin/pip install --quiet awscli

      - name: Publish main to Garage
        if: github.ref == 'refs/heads/main'
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.GARAGE_REPLICATED_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.GARAGE_REPLICATED_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: garage-replicated
          GARAGE_S3_ENDPOINT: https://s3-replicated.bcgen.ie
        run: |
          set -eu
          aws=/opt/awscli/bin/aws
          common="--endpoint-url $GARAGE_S3_ENDPOINT --no-progress"

          $aws $common s3 sync bundle-public s3://familyfed.ie --delete \
            --cache-control 'public, max-age=3600, must-revalidate'
          $aws $common s3 cp bundle-public s3://familyfed.ie --recursive \
            --exclude '*' --include '*.html' \
            --cache-control 'public, max-age=0, must-revalidate'
          $aws $common s3 cp bundle-public s3://familyfed.ie --recursive \
            --exclude '*' --include '*.json' \
            --cache-control 'public, max-age=0, must-revalidate'

          $aws $common s3 sync bundle-admin s3://admin.familyfed.ie --delete \
            --cache-control 'private, max-age=0, must-revalidate'
          $aws $common s3 cp bundle-admin s3://admin.familyfed.ie --recursive \
            --cache-control 'private, no-store'