name: CI

on:
  push:
    branches: ['**']
    tags: ['v*']
  pull_request:
    branches: ['**']

jobs:
  typecheck:
    name: TypeScript — type-check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install
        run: npm ci

      - name: Type-check (tsc)
        run: npx tsc --noEmit

  publish:
    name: Publish — build & push image
    runs-on: ubuntu-latest
    needs: [typecheck]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      # Gitea's registry, not registry.netork.io.
      #
      # registry.netork.io is plain registry:2 with htpasswd auth, which knows
      # nothing about repositories: every account that can log in reads and
      # writes everything on it, including the accounts issued to customer
      # instances. It keeps the images those instances are meant to pull
      # (netork/engine, netork/ui, netork/satellite); the marketing site is not
      # one of them. Gitea scopes packages to their owning account, and no
      # customer has one. netOrk issue #172.
      #
      # REGISTRY_TOKEN is a Gitea access token with write:package — the token
      # Actions injects per run is scoped to the repository API and the package
      # registry rejects it outright.
      - name: Login to registry
        run: |
          set -euo pipefail
          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
            echo "::error::REGISTRY_TOKEN is not set (Gitea token with write:package)."
            exit 1
          fi
          LOGIN_USER="${{ secrets.REGISTRY_USER }}"
          [ -n "$LOGIN_USER" ] || LOGIN_USER="${{ github.actor }}"
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.netork.io -u "$LOGIN_USER" --password-stdin

      - name: Build & push
        run: |
          set -euo pipefail
          SHA=$(git rev-parse --short HEAD)
          docker build \
            -t git.netork.io/netork/website:latest \
            -t git.netork.io/netork/website:main-${SHA} \
            .
          docker push git.netork.io/netork/website:latest
          docker push git.netork.io/netork/website:main-${SHA}

      - name: Logout
        if: always()
        run: docker logout git.netork.io

# The deploy job that used to live here has been removed, deliberately.
#
# It ran `docker run` against whatever runner picked the job up, which worked
# while exactly one runner existed. There are now several (netork-runner-12 on
# .12, netork-runner-13 on .13, and the original netork-runner) and none of them
# is on 10.7.224.11, where this site actually runs and where the proxy-net it
# attaches to lives. The job would therefore have started a second website
# container on the wrong host and reported success, while netork.io went on
# serving the old one.
#
# Deployment is now an explicit step: scripts/deploy.sh, run from a workstation,
# which targets .11 by name and verifies afterwards that the container really is
# on the image that was pulled.
#
# To get push-to-deploy back, either register a runner on .11 with a label of its
# own and pin `runs-on:` to it, or give CI an ssh key for .11. Both are choices
# about where a credential lives, so neither was made here.