name: deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: true

env:
  DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
  DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
  DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
  DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
  DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
  APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}

jobs:
  preflight:
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Fetch and reset workstation
        shell: bash
        run: |
          set -euo pipefail
          ./.gitea/workflows/ssh-run.sh preflight

  validate:
    needs: [preflight]
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Dry-run manifests and check Secrets
        shell: bash
        run: |
          set -euo pipefail
          ./.gitea/workflows/ssh-run.sh validate

  apply-k8s:
    needs: [validate]
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Apply Kubernetes manifests
        shell: bash
        run: |
          set -euo pipefail
          ./.gitea/workflows/ssh-run.sh apply-k8s

  apply-compose:
    needs: [validate]
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Redeploy docker compose stacks
        shell: bash
        run: |
          set -euo pipefail
          ./.gitea/workflows/ssh-run.sh apply-compose