name: Apply Supabase profile migrations

on:
  workflow_dispatch:

concurrency:
  group: supabase-profile-migrations
  cancel-in-progress: false

env:
  GITEA_SHA: ${{ gitea.sha }}
  DEPLOY_HOST: 103.117.123.53
  DEPLOY_PORT: '22000'
  DEPLOY_USER: root
  DEPLOY_PATH: /opt/jyotisha-app

jobs:
  apply:
    runs-on: xiaoxin
    timeout-minutes: 15
    steps:
      - name: Checkout current Gitea revision
        run: |
          set -euo pipefail
          git init .
          git remote remove origin 2>/dev/null || true
          git remote add origin https://git.copse.top/root/Jyotisha.git
          git fetch --no-tags origin "$GITEA_SHA" main
          git checkout --detach --force "$GITEA_SHA"
      - name: Verify runner toolchain and require current main
        run: |
          set -euo pipefail
          python3 --version
          node --version
          npm --version
          docker version
          test "$(git rev-parse HEAD)" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"
      - name: Configure SSH and apply reviewed files
        env: { SSH_PRIVATE_KEY: '${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}' }
        run: |
          set -euo pipefail
          install -m 700 -d ~/.ssh
          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production; chmod 600 ~/.ssh/jyotisha-production
          printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
          SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
          remote="$DEPLOY_PATH/tmp/profile-migrations/$GITEA_RUN_NUMBER"
          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "install -m 700 -d '$remote'"
          rsync -az -e "ssh $SSH_OPTIONS" frontend/supabase/migrations/20260718*.sql frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql "$DEPLOY_USER@$DEPLOY_HOST:$remote/"
          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && REMOTE_DIR='$remote' bash -s" <<'REMOTE'
          set -euo pipefail
          set +x
          trap 'rm -rf "$REMOTE_DIR"' EXIT
          set -a; . .env.production; set +a
          DB_URL="${SUPABASE_DB_URL:-${DATABASE_URL:-}}"
          test -n "$DB_URL"
          for sql_file in "$REMOTE_DIR"/*.sql; do
            echo "applying $(basename "$sql_file")"
            docker run --rm -i postgres:16-alpine psql "$DB_URL" --set ON_ERROR_STOP=1 --quiet < "$sql_file"
          done
          REMOTE