name: deploy admin (hub fleet)

# Rolls Hub releases that include the org-admin SPA (`admin-web` → registerStaticSpa)
# onto the managed Alpha host. Two fleets share one machine and are separated by
# the middle DNS label of each Silo's public URL:
#
#   dev  → https://<slug>.educraft-dev.paradigm-edu.net   (every push + PR)
#   prod → https://<slug>.educraft.paradigm-edu.net       (main + tags)
#
# Example prod tenant:
#   https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
#
# Required Gitea secret:
#   DEPLOY_SSH_KEY  — private key for root@39.107.254.4
#
# Optional secrets / vars (defaults match NEW_SILO_RUNBOOK):
#   DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_PORT, DEPLOY_BASE
#   vars.ALLOW_EMPTY_FLEET=1  — green when the fleet has no silos yet

on:
  push:
    paths:
      - "hub/**"
      - ".gitea/workflows/deploy-admin.yml"
  pull_request:
    paths:
      - "hub/**"
      - ".gitea/workflows/deploy-admin.yml"
  workflow_dispatch:
    inputs:
      fleet:
        description: "Which fleet to deploy (dev | prod | both)"
        required: true
        default: both
      allow_empty_fleet:
        description: "Succeed if no silo matches (1/0)"
        required: false
        default: "0"

concurrency:
  group: deploy-admin-host
  cancel-in-progress: false

jobs:
  deploy-dev:
    name: deploy fleet dev (educraft-dev)
    runs-on: ubuntu-latest
    if: >
      github.event_name == 'pull_request' ||
      (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
      (github.event_name == 'workflow_dispatch' &&
        (github.event.inputs.fleet == 'dev' || github.event.inputs.fleet == 'both'))
    steps:
      - uses: actions/checkout@v5

      - name: Install rsync + ssh
        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client

      - name: Deploy Hub + admin SPA to educraft-dev fleet
        env:
          CPH_FLEET: dev
          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
            echo "missing secret DEPLOY_SSH_KEY" >&2
            exit 1
          fi
          key="$(mktemp)"
          trap 'rm -f "$key"' EXIT
          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
          chmod 600 "$key"
          export PLATFORM_DEPLOY_SSH_KEY="$key"
          # Apply managed-host defaults when secrets are unset.
          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
          bash hub/deploy/deploy_fleet_release.sh

  deploy-prod:
    name: deploy fleet prod (educraft)
    runs-on: ubuntu-latest
    if: >
      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
      (github.event_name == 'workflow_dispatch' &&
        (github.event.inputs.fleet == 'prod' || github.event.inputs.fleet == 'both'))
    steps:
      - uses: actions/checkout@v5

      - name: Install rsync + ssh
        run: sudo apt-get update && sudo apt-get install -y rsync openssh-client

      - name: Deploy Hub + admin SPA to educraft fleet
        env:
          CPH_FLEET: prod
          PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
          PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
          PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
          ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
          DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
            echo "missing secret DEPLOY_SSH_KEY" >&2
            exit 1
          fi
          key="$(mktemp)"
          trap 'rm -f "$key"' EXIT
          printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
          chmod 600 "$key"
          export PLATFORM_DEPLOY_SSH_KEY="$key"
          export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
          export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
          export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
          export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
          bash hub/deploy/deploy_fleet_release.sh