name: Build and push server image

on:
  push:
    branches: [main]
    paths:
      - "server/**"
      - ".gitea/workflows/server-docker-build.yml"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        working-directory: server
        run: pip install -r requirements-dev.txt

      - name: Run tests
        working-directory: server
        run: pytest

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: git.thumeit.com
          username: tfaour
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: ./server
          push: true
          tags: |
            git.thumeit.com/tfaour/espresso-frame-server:latest
            git.thumeit.com/tfaour/espresso-frame-server:${{ gitea.sha }}

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Deploy over SSH
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT || '22' }}
        run: |
          mkdir -p ~/.ssh
          echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p "$DEPLOY_PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
          ssh -i ~/.ssh/deploy_key -p "$DEPLOY_PORT" -o StrictHostKeyChecking=yes \
            espressoframe_deployer@"$DEPLOY_HOST" bash -s <<'REMOTE'
          set -e
          cd ~/espresso-frame
          docker compose down --remove-orphans
          docker compose pull
          # "down" returning doesn't guarantee the OS/docker-proxy has
          # actually released port 8420 yet -- an immediate "up -d" right
          # after (especially with "pull" a no-op because the image was
          # already cached) can lose that race and fail with "port is
          # already allocated", even though the exact same "up -d" run a
          # few seconds later succeeds every time. Retry instead of
          # guessing at a fixed sleep long enough to always cover it.
          for i in $(seq 1 10); do
            if docker compose up -d; then
              exit 0
            fi
            echo "docker compose up -d failed (attempt $i/10) -- retrying in 3s"
            sleep 3
          done
          echo "docker compose up -d did not succeed after 10 attempts"
          exit 1
          REMOTE