name: CI Deploy Laravel

on:
  push:
    branches:
      - master

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          extensions: mbstring, ctype, fileinfo, openssl, pdo, tokenizer, xml
          coverage: none

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm

      - name: Install Composer dependencies
        run: composer install --no-interaction --no-progress --prefer-dist

      - name: Prepare environment
        run: |
          cp .env.example .env
          php artisan key:generate --force

      - name: Install NPM dependencies
        run: npm ci || npm install --no-audit --no-fund

      - name: Build frontend assets for tests
        run: npm run build

      - name: Run tests
        run: php artisan test --compact

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          extensions: mbstring, ctype, fileinfo, openssl, pdo, tokenizer, xml
          coverage: none

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm

      - name: Install production Composer dependencies
        run: composer install --no-dev --no-interaction --no-progress --prefer-dist --optimize-autoloader

      - name: Install NPM dependencies
        run: npm ci || npm install --no-audit --no-fund

      - name: Build frontend assets
        run: npm run build

      - name: Upload deployment artifact
        uses: actions/upload-artifact@v4
        with:
          name: laravel-build
          path: |
            app
            bootstrap
            config
            database
            public
            resources
            routes
            storage
            vendor
            artisan
            composer.json
            package.json
            vite.config.js
          if-no-files-found: warn

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Download build artifact
        uses: actions/download-artifact@v4
        with:
          name: laravel-build
          path: release

      - name: Install sshpass
        run: sudo apt-get update && sudo apt-get install -y sshpass

      - name: Add SSH host to known_hosts
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          if [ -n "$DEPLOY_KNOWN_HOSTS" ]; then
            echo "$DEPLOY_KNOWN_HOSTS" >> ~/.ssh/known_hosts
          else
            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" >> ~/.ssh/known_hosts
          fi

      - name: Deploy files with rsync over SSH
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
        run: |
          if [ -z "$DEPLOY_PASSWORD" ]; then
            echo "DEPLOY_PASSWORD secret is empty."
            exit 1
          fi

          mkdir -p ~/.ssh
          rsync -az --delete \
            -e "sshpass -e ssh -p ${DEPLOY_PORT:-22}" \
            --exclude='.env' \
            --exclude='storage/logs/*' \
            --exclude='storage/framework/cache/*' \
            --exclude='storage/framework/sessions/*' \
            --exclude='storage/framework/views/*' \
            release/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"

      - name: Create .env on server from secret
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_ENV_FILE: ${{ secrets.DEPLOY_ENV_FILE }}
          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
        run: |
          if [ -z "$DEPLOY_ENV_FILE" ]; then
            echo "DEPLOY_ENV_FILE secret is empty."
            exit 1
          fi

          if [ -z "$DEPLOY_PASSWORD" ]; then
            echo "DEPLOY_PASSWORD secret is empty."
            exit 1
          fi

          printf '%s' "$DEPLOY_ENV_FILE" | sshpass -e ssh -p "${DEPLOY_PORT:-22}" "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p \"${DEPLOY_PATH}\" && cat > \"${DEPLOY_PATH}/.env\" && chmod 600 \"${DEPLOY_PATH}/.env\""

      - name: Run post-deploy Laravel commands
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
        run: |
          if [ -z "$DEPLOY_PASSWORD" ]; then
            echo "DEPLOY_PASSWORD secret is empty."
            exit 1
          fi

          sshpass -e ssh -p "${DEPLOY_PORT:-22}" "${DEPLOY_USER}@${DEPLOY_HOST}" "cd ${DEPLOY_PATH} && php artisan optimize:clear && php artisan config:cache && php artisan route:cache && php artisan view:cache"

# Required repository secrets:
# - DEPLOY_HOST: Server hostname or IP.
# - DEPLOY_PORT: SSH port (optional, defaults to 22).
# - DEPLOY_USER: SSH user for deployment.
# - DEPLOY_PASSWORD: SSH password for deployment user.
# - DEPLOY_PATH: Absolute path of the Laravel app on the server.
# - DEPLOY_KNOWN_HOSTS: Optional pinned known_hosts line(s) for stricter host verification.
# - DEPLOY_ENV_FILE: Full .env content as a multiline secret (contains APP_KEY, DB_*, etc).