name: Next CI-CD

on:
  push:
    branches: ["main"]

env:
  BUN_IMAGE: oven/bun:1-alpine
  KAMAL_IMAGE: ghcr.io/basecamp/kamal:v2.11.0

jobs:
  deploy:
    name: Lint, Build and Deploy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Lint and build
        run: |
          set -eu
          docker run --rm \
            --user "$(id -u):$(id -g)" \
            -e HOME=/tmp \
            -e NEXT_TELEMETRY_DISABLED=1 \
            -v "$PWD:/app" \
            -w /app \
            "$BUN_IMAGE" \
            sh -lc "bun install --frozen-lockfile && bun run lint && bun run build"

      - name: Deploy with Kamal
        env:
          GITEA_TOKEN: ${{ secrets.TOKEN_GITEA }}
          SSH_HOST: ${{ secrets.SSH_HOST }}
          SSH_USER: ${{ secrets.SSH_USER }}
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          set -eu

          : "${GITEA_TOKEN:?TOKEN_GITEA secret is required}"
          : "${SSH_PRIVATE_KEY:?SSH_PRIVATE_KEY secret is required}"
          : "${SSH_HOST:=89.167.35.217}"
          : "${SSH_USER:=root}"
          export SSH_HOST SSH_USER

          WORKSPACE="${GITHUB_WORKSPACE:-$PWD}"
          test -f "$WORKSPACE/config/deploy.yml"

          tar \
            --exclude=.git \
            --exclude=.next \
            --exclude=.kamal/secrets \
            --exclude=.kamal/secrets.* \
            --exclude=.env \
            --exclude=.env.* \
            --exclude=node_modules \
            -C "$WORKSPACE" -cf - . | docker run --rm -i \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -e GITEA_TOKEN \
            -e SSH_HOST \
            -e SSH_USER \
            -e SSH_PRIVATE_KEY \
            --entrypoint /bin/sh \
            "$KAMAL_IMAGE" -lc '
              set -eu

              mkdir -p /workdir /root/.ssh
              tar -xf - -C /workdir
              cd /workdir

              chmod 700 /root/.ssh
              printf "%s\n" "$SSH_PRIVATE_KEY" | tr -d "\r" > /root/.ssh/id_ed25519
              chmod 600 /root/.ssh/id_ed25519

              mkdir -p /workdir/.ssh
              cat > /workdir/.ssh/config <<'"'"'SSH_CONFIG'"'"'
          Host *
            IdentityFile /root/.ssh/id_ed25519
            IdentitiesOnly yes
            StrictHostKeyChecking yes
            UserKnownHostsFile /workdir/.ssh/known_hosts
            GlobalKnownHostsFile /dev/null
            CheckHostIP no
          SSH_CONFIG
              ssh-keyscan -H "$SSH_HOST" > /workdir/.ssh/known_hosts
              chmod 600 /workdir/.ssh/config /workdir/.ssh/known_hosts

              mkdir -p .kamal
              cat > .kamal/secrets <<'"'"'SECRETS'"'"'
          GITEA_TOKEN=$GITEA_TOKEN
          SSH_PRIVATE_KEY=$SSH_PRIVATE_KEY
          SECRETS
              chmod 600 .kamal/secrets

              /kamal/bin/kamal deploy
            '