name: Deploy to production

on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build production artifact
    environment: Production
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
          lfs: false
      - uses: actions/setup-node@v6
        with:
          node-version: lts/*
          cache: "npm"
      - name: Install Dependencies
        run: npm ci
      - name: Build
        run: npm run build -mode production
      - name: Archive Production Artifact
        uses: actions/upload-artifact@v5
        with:
          name: production
          path: dist
          retention-days: 1

  deploy:
    runs-on: ubuntu-latest
    needs: build
    name: Deploy to production server
    environment: Production
    steps:
      - name: Download Artifact
        uses: actions/download-artifact@v6
        with:
          name: production
          path: dist
      - name: Connect to tailnet
        uses: tailscale/github-action@v4
        with:
          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
          oauth-secret: ${{ secrets.TAILSCALE_CLIENT_SECRET }}
          tags: tag:ci
      - name: Wait for reachability
        run: |
          until tailscale ping --c=1 --until-direct=false ${{ secrets.TARGET_HOST }}; do
            echo "Waiting for Tailscale to connect..."
            sleep 2
          done
      - name: Add SSH Key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H ${{ secrets.TARGET_HOST }} >> ~/.ssh/known_hosts
      - name: Deploy
        run: |
          rsync -avz dist/ ${{ secrets.TARGET_USER }}@${{ secrets.TARGET_HOST }}:${{ secrets.TARGET_PATH }}/