name: CI/CD

on:
  push:
    branches: [main]
  pull_request:

jobs:

  # ── Test ──────────────────────────────────────────────────────────────────
  # Runs on every push and every PR. Must pass before deploy proceeds.
  test:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      - name: Run unit tests
        run: go test ./...

      - name: Build binary (compile check)
        run: CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /dev/null .

  # ── Deploy ────────────────────────────────────────────────────────────────
  # Runs only on push to main. SSH into the Synology, pull, rebuild, restart.
  #
  # Required secrets (set in Gitea → Repository → Settings → Secrets):
  #   DEPLOY_HOST  — Synology LAN IP or hostname  (e.g. 192.168.0.10)
  #   DEPLOY_USER  — SSH user with docker access   (e.g. ems-deploy)
  #   DEPLOY_KEY   — SSH private key (PEM, no passphrase)
  #   DEPLOY_PATH  — Absolute path to this repo on the Synology (e.g. /opt/ems)
  #
  # One-time setup on Synology:
  #   1. Create a dedicated deploy user (or reuse existing)
  #   2. Add the deploy public key to ~/.ssh/authorized_keys
  #   3. Add the user to the 'docker' group: sudo synogroup --member docker deploy-user
  deploy:
    needs: test
    runs-on: self-hosted
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Install SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          # Suppress host key prompt — runner talks to a known LAN host
          echo "Host ${{ secrets.DEPLOY_HOST }}" >> ~/.ssh/config
          echo "  StrictHostKeyChecking no"      >> ~/.ssh/config
          echo "  IdentityFile ~/.ssh/deploy_key" >> ~/.ssh/config

      - name: Deploy to Synology
        run: |
          ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
            "cd ${{ secrets.DEPLOY_PATH }} \
             && git pull --ff-only \
             && docker compose up -d --build \
             && docker image prune -f"

      - name: Verify health
        run: |
          # Wait for container to come up, then check /health via LAN
          sleep 10
          ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
            "wget -qO- http://localhost:9099/health"