name: Deploy
on:
  push:
    branches: [master]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "26"

      - name: Install
        run: npm ci

      - name: Build
        run: npm run build

      - name: Test
        run: npm test

      - name: Build and smoke-test the container
        # vu has no server-side logic, so there's nothing an integration
        # test would exercise beyond "does the built bundle actually get
        # served correctly under the /vu/ base path" — this is that check,
        # run against the exact image that ships.
        #
        # The runner shares the host's Docker daemon, so a hardcoded host
        # port (this used to be -p 8080:80) is contended across every repo's
        # CI on the same host, not scoped to this job — hence the earlier
        # "port already allocated" failures even after cleaning up any
        # leftover vu-smoke container. Curl the container's own IP instead,
        # so no host port is published at all — but this job's own sandbox
        # container lives on the "reground" network, not the default bridge,
        # so vu-smoke has to join that same network or the two can't reach
        # each other at all (that's why the first attempt at this just hung
        # for 2 minutes before timing out, rather than failing fast).
        run: |
          docker rm -f vu-smoke 2>/dev/null || true
          docker build -t vu:ci .
          docker run -d --name vu-smoke --network reground vu:ci
          sleep 1
          container_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' vu-smoke)
          curl -sf "http://${container_ip}/" | grep -q 'vu — Divine Office'
          docker stop vu-smoke
          docker rm vu-smoke

      - name: Trigger redeploy via SSH
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "$VU_DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          # Forced-command key, same pattern as eec/bookshop/drip: the
          # server-side sudoers grant runs the vu redeploy script regardless
          # of what's requested here — see the vu Ansible role.
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new vu-deploy@reground.org true
        env:
          VU_DEPLOY_SSH_KEY: ${{ secrets.VU_DEPLOY_SSH_KEY }}