name: Deploy test site

# Builds site/dist (site/public/ plus demo pages copied out of docs/, see
# site/build.sh) and publishes it to the B4L package registry as the generic
# package B4L/cnxvinyl.lol. bkk01 serves https://cnxvinyl.lol/ from those
# releases (cnx-network-clan, docs/src/s1-migration.md): the registry's
# package event makes it fetch a new version within seconds, and a timer
# there fetches every 15 minutes as a backstop.
#
# Secrets (organization level): REGISTRY_USER, REGISTRY_TOKEN, an account with
# a write:package token in a B4L team that may write packages (b4l-ci). The
# job's own token only reads the repository: the registry refuses it.

on:
  push:
    branches: [master]
    paths:
      - "site/**"
      - "docs/**/*.html"
      - "docs/pitch/**"
      - ".gitea/workflows/deploy-site.yml"
  workflow_dispatch:

# A newer push supersedes a running deploy; bkk01 serves whichever version
# the registry lists as the latest.
concurrency:
  group: deploy-cnxvinyl-lol
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      SITE_URL: https://cnxvinyl.lol
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build site/dist
        run: bash site/build.sh

      - name: Publish to the package registry
        # The version joins the UTC time and the commit, so versions never
        # collide. The archive holds the site's root itself.
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
            echo "::error::REGISTRY_USER and REGISTRY_TOKEN must be set as organization secrets"
            exit 1
          fi
          version="$(date -u +%Y%m%dT%H%M%S)-${GITHUB_SHA::12}"
          tar -czf site.tar.gz -C site/dist .
          curl -fsS --user "$REGISTRY_USER:$REGISTRY_TOKEN" --upload-file site.tar.gz \
            "${{ github.server_url }}/api/packages/${{ github.repository_owner }}/generic/cnxvinyl.lol/$version/site.tar.gz"
          echo "published cnxvinyl.lol $version ($(du -h site.tar.gz | cut -f1))"

      - name: Check the public URL
        # bkk01 fetches the release a few seconds after the upload; give it up
        # to two minutes. Warning only: the release is in the registry either
        # way, and the timer on bkk01 picks it up.
        run: |
          expected=$(cat site/dist/version.txt)
          for i in $(seq 1 24); do
            got=$(curl -sS --max-time 20 "$SITE_URL/version.txt?nocache=$expected" || true)
            if [ "$got" = "$expected" ]; then
              echo "$SITE_URL serves $expected"
              exit 0
            fi
            sleep 5
          done
          echo "::warning::$SITE_URL/version.txt returned '${got:0:80}', expected $expected"