name: CD
on:
  push:
    tags: ["v*"]

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    container:
      image: python:3.11-bookworm
    steps:
      - name: Tooling (ssh client)
        run: |
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends openssh-client

      - name: Configure SSH
        run: |
          install -d -m700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_deploy
          chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
        env:
          DEPLOY_SSH_KEY:     ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}

      - name: Deploy ${{ github.ref_name }}
        run: |
          ssh -i ~/.ssh/id_deploy -o IdentitiesOnly=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "cd \"\${PORTAL_DIR:-/opt/portal/app}\" && git fetch --tags --quiet && git show '${TAG}:deploy/deploy.sh' | bash -s -- '${TAG}'"
        env:
          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
          TAG:         ${{ github.ref_name }}