name: Build & Deploy

on:
  push:
    branches: [master, main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          # Fuld historik: astro.config.mjs udleder sitemap-lastmod fra hver sides
          # sidste commit, og IndexNow-steppet differ pushet. Begge er værdiløse
          # med den default shallow clone (fetch-depth: 1).
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22

      # The runner forces omit of optional deps, dropping @img/sharp-linux-x64
      # (sharp's platform binary) -> astro:assets MissingSharp. Clear the omit
      # env and force-install the linux/glibc/x64 sharp binary per sharp's
      # official cross-platform install, then verify it loads.
      - name: Install dependencies
        env:
          npm_config_omit: ""
          npm_config_optional: "true"
        run: |
          npm install --include=optional
          npm install --include=optional --os=linux --libc=glibc --cpu=x64 sharp
          node -e "console.log('sharp', require('sharp').versions.sharp)"

      # Intet indlæg bygges uden godkendelse; se scripts/verify-approvals.mjs.
      - name: Verify blog approvals
        env:
          PUBLISH_KEY: ${{ secrets.PUBLISH_KEY }}
        run: node scripts/verify-approvals.mjs

      - name: Build site
        run: npm run build

      # tar over SSH (the runner image has no rsync). Build is unpacked into
      # a .new dir on the web host and atomically swapped in, so the live web
      # root is never left half-written. Host and path are repository secrets,
      # not variables: run logs of a public repo are public, and Gitea prints
      # variables in them but masks secrets.
      - name: Deploy dist/ over SSH
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
        run: |
          set -euo pipefail
          : "${DEPLOY_HOST:?repository secret DEPLOY_HOST is not set}"
          : "${DEPLOY_USER:?repository variable DEPLOY_USER is not set}"
          : "${DEPLOY_PATH:?repository secret DEPLOY_PATH is not set}"
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          SSH="ssh -i $HOME/.ssh/deploy_key -o StrictHostKeyChecking=accept-new"
          ssh-keyscan -t ed25519 "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
          $SSH "$DEPLOY_USER@$DEPLOY_HOST" "rm -rf $DEPLOY_PATH.new && mkdir -p $DEPLOY_PATH.new"
          tar -C dist -czf - . | $SSH "$DEPLOY_USER@$DEPLOY_HOST" \
            "tar -C $DEPLOY_PATH.new -xzf - \
             && rm -rf $DEPLOY_PATH.old \
             && { mv $DEPLOY_PATH $DEPLOY_PATH.old 2>/dev/null || true; } \
             && mv $DEPLOY_PATH.new $DEPLOY_PATH \
             && rm -rf $DEPLOY_PATH.old"

      # Fortæl Bing/Yandex m.fl. med det samme hvilke sider der ændrede sig.
      # Kører EFTER deploy, så nøglefilen og siderne er live når de kommer og tjekker.
      # Google understøtter ikke IndexNow. Må aldrig vælte et ellers vellykket deploy.
      - name: Ping IndexNow
        continue-on-error: true
        env:
          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
        run: node scripts/indexnow.mjs