name: Deploy to VPS

on:
  push:
    branches:
      - master
  workflow_dispatch:

# Prevent concurrent deployments from racing
concurrency:
  group: deploy-vps-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  OWNER: mytheclipse


jobs:
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      max-parallel: 2
      matrix:
        service: [frontend, backend, discord-gateway, proxy]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push ${{ matrix.service }}
        uses: docker/build-push-action@v7
        with:
          context: .
          file: infra/docker/Dockerfile.${{ matrix.service }}
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:latest
            ${{ env.REGISTRY }}/${{ env.OWNER }}/bete-${{ matrix.service }}:${{ github.sha }}
          cache-from: type=gha,scope=bete-${{ matrix.service }}
          cache-to: type=gha,mode=max,scope=bete-${{ matrix.service }}
          build-args: |
            VITE_BE_API_URL=https://imphnen.asepharyana.my.id
            VITE_BE_WS_URL=wss://imphnen.asepharyana.my.id

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'
    steps:
      - name: Deploy to VPS
        uses: appleboy/ssh-action@v1.2.5
        env:
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ENV_FILE: ${{ secrets.ENV_FILE }}
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USERNAME }}
          key: ${{ secrets.VPS_SSH_KEY }}
          envs: GHCR_USERNAME,GHCR_TOKEN,ENV_FILE
          script: |
            set -eu

            APP_DIR=/opt/imphenbot
            REPO_URL=https://github.com/MythEclipse/GMW.git

            if [ -d "$APP_DIR/.git" ]; then
              ORIGIN=$(git -C "$APP_DIR" remote get-url origin 2>/dev/null || true)
              if [ "$ORIGIN" != "$REPO_URL" ]; then
                rm -rf "$APP_DIR"
              fi
            fi

            if [ ! -d "$APP_DIR/.git" ]; then
              mkdir -p "$APP_DIR"
              git clone --depth 1 --branch master "$REPO_URL" "$APP_DIR"
            else
              git -C "$APP_DIR" fetch --depth 1 origin master
              git -C "$APP_DIR" checkout master
              git -C "$APP_DIR" reset --hard origin/master
            fi

            cd "$APP_DIR"

            mkdir -p infra/docker/recordings
            # Set permissions for recordings directory (writable by container app user UID 100)
            chmod -R 777 infra/docker/recordings

            # Write env file — strip \r to avoid configuration issues
            printf '%s\n' "$ENV_FILE" | tr -d '\r' > infra/docker/.env

            echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin

            # Force stop any stale containers from previous deployments
            docker rm -f imphenbot-proxy imphenbot-backend imphenbot-frontend imphenbot-discord-gateway 2>/dev/null || true

            # Retry docker pull up to 3 times on transient network errors
            RETRIES=3
            for i in $(seq 1 $RETRIES); do
              echo "docker compose pull (attempt $i/$RETRIES)"
              if docker compose -f infra/docker/docker-compose.yml pull; then
                echo "Pull succeeded"
                break
              else
                echo "Pull failed (attempt $i/$RETRIES)"
                if [ "$i" -eq "$RETRIES" ]; then
                  echo "All pull attempts failed" >&2
                  exit 1
                fi
                sleep 5
              fi
            done

            # Remove orphan containers but don't block on healthchecks —
            # containers have restart: unless-stopped and will recover on their own
            docker compose -f infra/docker/docker-compose.yml up -d --remove-orphans
            docker image prune -f