name: Build & Deploy

on:
  push:
    branches: [master, main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          # Fuld historik til sitemap-lastmod og IndexNow
          fetch-depth: 0

      - name: Verify blog approvals
        env:
          PUBLISH_KEY: ${{ secrets.PUBLISH_KEY }}
        run: python3 scripts/verify-approvals.py

      - name: Fetch zola and tailwind
        run: sh scripts/hent-vaerktoej.sh

      - name: Build site
        run: sh scripts/build.sh

      # tar over SSH med atomisk swap (runner-imaget har ikke rsync)
      - name: Deploy public/ over SSH
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
        run: |
          set -euo pipefail
          : "${DEPLOY_HOST:?repository secret DEPLOY_HOST is not set}"
          : "${DEPLOY_USER:?repository variable DEPLOY_USER is not set}"
          : "${DEPLOY_PATH:?repository secret DEPLOY_PATH is not set}"
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          SSH="ssh -i $HOME/.ssh/deploy_key -o StrictHostKeyChecking=accept-new"
          ssh-keyscan -t ed25519 "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
          $SSH "$DEPLOY_USER@$DEPLOY_HOST" "rm -rf $DEPLOY_PATH.new && mkdir -p $DEPLOY_PATH.new"
          tar -C public -czf - . | $SSH "$DEPLOY_USER@$DEPLOY_HOST" \
            "tar -C $DEPLOY_PATH.new -xzf - \
             && rm -rf $DEPLOY_PATH.old \
             && { mv $DEPLOY_PATH $DEPLOY_PATH.old 2>/dev/null || true; } \
             && mv $DEPLOY_PATH.new $DEPLOY_PATH \
             && rm -rf $DEPLOY_PATH.old"

      - name: Ping IndexNow
        continue-on-error: true
        env:
          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
        run: python3 scripts/indexnow.py