name: Build & Deploy (Nix)

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: booster-role-deploy
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install deps
        run: bun install --frozen-lockfile

      - name: Typecheck
        run: bun run typecheck

      - name: Test
        run: bun test

  build-and-deploy:
    needs: test
    runs-on: ubuntu-latest
    environment: orangevps

    steps:
      - uses: actions/checkout@v4

      - uses: DeterminateSystems/nix-installer-action@v16
        with:
          determinate: false
          extra-conf: |
            sandbox = false
            accept-flake-config = true

      - uses: DeterminateSystems/magic-nix-cache-action@v14
        with:
          use-flakehub: false

      - name: Build & Deploy
        env:
          VPS_HOST: ${{ secrets.VPS_HOST }}
          VPS_USER: ${{ secrets.VPS_USER }}
          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
        run: |
          set -eu
          STORE_PATH=$(nix build . --impure --option sandbox false --no-link --print-out-paths | tail -1)
          echo "Store path: $STORE_PATH"

          key_file=$(mktemp /tmp/deploy-key.XXXXXX)
          printf '%s\n' "$VPS_SSH_KEY" > "$key_file"
          chmod 600 "$key_file"
          sed -i 's/\r$//' "$key_file"
          ssh-keygen -y -f "$key_file" >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }

          export NIX_SSHOPTS="-i $key_file -o StrictHostKeyChecking=no"
          nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "$STORE_PATH" 2>&1

          ssh -i "$key_file" -o StrictHostKeyChecking=no "${VPS_USER}@${VPS_HOST}" "
            set -eu
            if [ -d /nix/var/nix/profiles/booster-role ] && [ ! -L /nix/var/nix/profiles/booster-role ]; then
              rm -rf /nix/var/nix/profiles/booster-role
            fi
            nix-env --profile /nix/var/nix/profiles/booster-role --set $STORE_PATH
            systemctl daemon-reload
            systemctl enable booster-role 2>/dev/null || true
            systemctl restart booster-role
            for i in \$(seq 1 30); do
              systemctl is-active --quiet booster-role && break
              sleep 1
            done
            systemctl is-active booster-role || {
              echo \"=== SERVICE FAILED — journal ===\"
              journalctl -u booster-role -n 40 --no-pager
              exit 1
            }
            systemctl status booster-role --no-pager 2>&1 | head -8
          " 2>&1

  cleanup:
    # Bersihkan sampah Nix di VPS SETELAH deploy: hapus generasi profile lama
    # + nix store gc. Profil yang sedang dipakai tidak disentuh.
    needs: build-and-deploy
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Nix GC on VPS
        env:
          VPS_HOST: ${{ secrets.VPS_HOST }}
          VPS_USER: ${{ secrets.VPS_USER }}
          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
          ssh "$VPS_USER@$VPS_HOST" "sudo /usr/local/bin/nix-gc-vps.sh" || echo "⚠️ Nix GC gagal (non-fatal)"