name: Deploy production

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: production
  cancel-in-progress: false

env:
  DEPLOY_HOST: 103.117.123.53
  DEPLOY_PORT: "22000"
  DEPLOY_USER: root
  DEPLOY_PATH: /opt/jyotisha-app

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout tested revision
        uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}

      - name: Reject stale CI revision
        id: revision
        run: |
          tested_sha="$(git rev-parse HEAD)"
          main_sha="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
          if [ "$tested_sha" = "$main_sha" ]; then
            echo "deploy=true" >> "$GITHUB_OUTPUT"
            echo "Deploying current main revision $tested_sha"
          else
            echo "deploy=false" >> "$GITHUB_OUTPUT"
            echo "Skipping stale CI revision $tested_sha; current main is $main_sha"
          fi

      - name: Configure SSH
        if: steps.revision.outputs.deploy == 'true'
        env:
          SSH_PRIVATE_KEY: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production
          chmod 600 ~/.ssh/jyotisha-production
          printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts

      - name: Sync reviewed production environment keys
        if: steps.revision.outputs.deploy == 'true'
        env:
          GEOAPIFY_API_KEY: ${{ secrets.GEOAPIFY_API_KEY }}
          VEDASTRO_API_KEY: ${{ secrets.VEDASTRO_API_KEY }}
          VEDASTRO_API_ENDPOINT: ${{ secrets.VEDASTRO_API_ENDPOINT }}
          VEDASTRO_ENABLE_NETWORK: ${{ secrets.VEDASTRO_ENABLE_NETWORK }}
          VEDASTRO_GATEWAY_MODE: ${{ secrets.VEDASTRO_GATEWAY_MODE }}
          VEDASTRO_RANGE_SCAN_NETWORK_ENABLED: ${{ secrets.VEDASTRO_RANGE_SCAN_NETWORK_ENABLED }}
          VEDASTRO_TIMEOUT_SECONDS: ${{ secrets.VEDASTRO_TIMEOUT_SECONDS }}
          JYOTISH_DYNAMIC_RECTIFICATION_TOKEN: ${{ secrets.JYOTISH_DYNAMIC_RECTIFICATION_TOKEN }}
        run: |
          set -euo pipefail
          set +x
          UPDATE_FILE="$RUNNER_TEMP/production-env-update.json"
          REMOTE_UPDATE_FILE="$DEPLOY_PATH/.env.production.update.$GITHUB_RUN_ID"
          export UPDATE_FILE
          umask 077
          python3 - <<'PY'
          import json
          import os
          from pathlib import Path

          keys = (
              "GEOAPIFY_API_KEY",
              "VEDASTRO_API_KEY",
              "VEDASTRO_API_ENDPOINT",
              "VEDASTRO_ENABLE_NETWORK",
              "VEDASTRO_GATEWAY_MODE",
              "VEDASTRO_RANGE_SCAN_NETWORK_ENABLED",
              "VEDASTRO_TIMEOUT_SECONDS",
              "JYOTISH_DYNAMIC_RECTIFICATION_TOKEN",
          )
          values = {key: os.environ.get(key, "") for key in keys}
          missing = [key for key, value in values.items() if not value]
          if missing:
              raise SystemExit("required production environment secret is missing")
          Path(os.environ["UPDATE_FILE"]).write_text(
              json.dumps(values, ensure_ascii=False),
              encoding="utf-8",
          )
          PY
          SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
          SCP_OPTIONS="-i $HOME/.ssh/jyotisha-production -P $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
          scp $SCP_OPTIONS "$UPDATE_FILE" "$DEPLOY_USER@$DEPLOY_HOST:$REMOTE_UPDATE_FILE"
          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" \
            "cd '$DEPLOY_PATH' && python3 - '$REMOTE_UPDATE_FILE'" <<'PY'
          import json
          import os
          import re
          import sys
          import tempfile
          from pathlib import Path

          env_path = Path(".env.production")
          update_path = Path(sys.argv[1])
          try:
              if not env_path.is_file():
                  raise SystemExit("production environment file is missing")
              updates = json.loads(update_path.read_text(encoding="utf-8"))
              if not isinstance(updates, dict) or not updates:
                  raise SystemExit("production environment update is empty")
              for key, value in updates.items():
                  if not re.fullmatch(r"[A-Z][A-Z0-9_]*", key):
                      raise SystemExit("production environment key is invalid")
                  if not isinstance(value, str) or not value or "\n" in value or "\0" in value:
                      raise SystemExit("production environment value is invalid")

              original = env_path.read_text(encoding="utf-8").splitlines()
              output = []
              written = set()
              assignment = re.compile(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=")

              def quote(value):
                  return "'" + value.replace("'", "'\"'\"'") + "'"

              for line in original:
                  match = assignment.match(line)
                  key = match.group(1) if match else None
                  if key not in updates:
                      output.append(line)
                      continue
                  if key not in written:
                      output.append(f"{key}={quote(updates[key])}")
                      written.add(key)
              for key, value in updates.items():
                  if key not in written:
                      output.append(f"{key}={quote(value)}")

              fd, temporary_name = tempfile.mkstemp(
                  prefix=".env.production.",
                  dir=str(env_path.parent),
                  text=True,
              )
              try:
                  with os.fdopen(fd, "w", encoding="utf-8") as handle:
                      handle.write("\n".join(output) + "\n")
                      handle.flush()
                      os.fsync(handle.fileno())
                  os.chmod(temporary_name, 0o600)
                  os.replace(temporary_name, env_path)
              finally:
                  if os.path.exists(temporary_name):
                      os.unlink(temporary_name)
              print(f"updated {len(updates)} production environment keys")
          finally:
              update_path.unlink(missing_ok=True)
          PY
          rm -f "$UPDATE_FILE"

      - name: Sync and rebuild
        if: steps.revision.outputs.deploy == 'true'
        env:
          DEPLOY_GIT_SHA: ${{ github.sha }}
        run: |
          SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
          RSYNC_SSH="ssh $SSH_OPTIONS"
          rsync -az --delete \
            --exclude='.git/' \
            --exclude='.env.production' \
            --exclude='frontend/node_modules/' \
            --exclude='frontend/.next/' \
            -e "$RSYNC_SSH" \
            ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"

          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" \
            "cd '$DEPLOY_PATH' && GITHUB_SHA='$DEPLOY_GIT_SHA' docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"

      - name: Verify production
        if: steps.revision.outputs.deploy == 'true'
        env:
          DEPLOY_GIT_SHA: ${{ github.sha }}
        run: |
          curl --fail --silent --show-error --retry 12 --retry-delay 5 https://jyotisha.chat/login >/dev/null
          test "$(curl --silent --output /dev/null --write-out '%{http_code}' https://jyotisha.chat/api/account)" = "401"
          deployed_sha=""
          for attempt in $(seq 1 24); do
            deployed_sha="$(curl --fail --silent --show-error https://jyotisha.chat/api/health | python3 -c 'import json, sys; print(json.load(sys.stdin).get("deployment", {}).get("gitCommit", ""))')" || deployed_sha=""
            [ "$deployed_sha" = "$DEPLOY_GIT_SHA" ] && break
            sleep 5
          done
          test "$deployed_sha" = "$DEPLOY_GIT_SHA" || { echo "Production revision did not converge: expected $DEPLOY_GIT_SHA, got ${deployed_sha:-empty}" >&2; exit 1; }
          ssh -i ~/.ssh/jyotisha-production -p "$DEPLOY_PORT" \
            -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20 \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml exec -T web node -e 'fetch(\"http://api:5200/api/health\").then(async r => { const body = await r.json(); if (!r.ok || body.status !== \"ok\" || body.swisseph_available !== true) process.exit(1); console.log(JSON.stringify(body)); })'"