# Builds and checks the site on every push to main. Deploys run from the laptop (deploy/deploy.sh),
# so port 22 stays open to one address only. To deploy from here instead, set these secrets
# and open port 22 to everyone in the provider's firewall:
#   DEPLOY_KEY          private half of an SSH key made only for this (ssh-keygen -t ed25519)
#   DEPLOY_KNOWN_HOSTS  the server's host key line, checked against the server itself (see deploy/DEPLOY.md)
#   DEPLOY_TARGET       for example deploy@web.example.com:
# Until DEPLOY_TARGET is set, the site is built and checked on every push, and the copy is skipped.
#
# The actions are pinned to full commit SHAs: a tag can be moved, a commit cannot.
# To update one, look up the new release's commit, e.g.
#   git ls-remote https://github.com/actions/checkout.git 'refs/tags/v7*'
name: Deploy
on:
  push:
    branches: [main]
  workflow_dispatch:
permissions:
  contents: read
concurrency: deploy
jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      # Secrets cannot be tested in an if: directly, so expose the one that decides
      HAS_TARGET: ${{ secrets.DEPLOY_TARGET != '' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1    # v7.0.1
        with:
          persist-credentials: false   # the job never pushes, so keep no token on disk
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: 24
      - name: Build (fails on placeholders or possible leaks)
        run: node build.mjs --strict
      - name: Check the puzzles (every generated puzzle has exactly one answer)
        run: node src/iq/test.js 300 | grep -E '^(Generated|FAILS|WARN)'
      - name: No server yet
        if: env.HAS_TARGET != 'true'
        run: echo "::notice::DEPLOY_TARGET is not set; the site was built and checked, not copied."
      - name: Copy to the server
        if: env.HAS_TARGET == 'true'
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
          KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          TARGET: ${{ secrets.DEPLOY_TARGET }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/deploy && chmod 600 ~/.ssh/deploy
          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
          trap 'rm -f ~/.ssh/deploy' EXIT
          rsync -rlz --delete --checksum --itemize-changes \
            -e "ssh -i ~/.ssh/deploy -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
            public/ "$TARGET"