name: Deploy Workshop-Wahlen (DEV / PROD)

on:
  push:
    branches:
      - develop
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    container:
      image: docker.gitea.com/runner-images:ubuntu-latest

    steps:
      # =====================
      # CHECKOUT
      # =====================
      - name: Checkout Repository
        uses: actions/checkout@v4

      # =====================
      # DEBUG (kann später raus)
      # =====================
      - name: Debug workspace
        run: |
          echo "PWD:"
          pwd
          echo "FILES:"
          ls -la

      # =====================
      # DEV DEPLOY (FTP)
      # =====================
      - name: Deploy to DEV via FTP
        if: github.ref == 'refs/heads/develop'
        run: |
          apt-get update
          apt-get install -y lftp

          lftp -u "${{ secrets.FTP_USER }},${{ secrets.FTP_PASS }}" ftp://${{ secrets.FTP_HOST }}:${{ secrets.FTP_PORT }} <<EOF
          set ftp:ssl-allow no
          set net:timeout 20
          set net:max-retries 2
          set mirror:parallel-transfer-count 2
          mirror -R --delete --verbose ./ /dev.konfi-castle.com/wp-content/plugins/konficastle-workshopwahl/
          quit
          EOF

      # =====================
      # PROD DEPLOY (FTP)
      # =====================
      - name: Deploy to PROD via SSH
        if: github.ref == 'refs/heads/main'
        env:
          SSH_HOST: ${{ secrets.PROD_SSH_HOST }}
          SSH_USER: ${{ secrets.PROD_SSH_USER }}
          SSH_PORT: ${{ secrets.PROD_SSH_PORT }}
          SSH_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
          HOST_WP_ROOT: ${{ secrets.PROD_HOST_WP_ROOT }}
          HOST_ABS_PLUGIN_PATH: ${{ secrets.PROD_HOST_ABS_PLUGIN_PATH }}
        run: |
          set -euo pipefail
          apt-get update
          # openssh-client to auth; tar for packaging with excludes
          apt-get install -y openssh-client tar

          # Prepare SSH key
          mkdir -p ~/.ssh
          # Write the multiline private key exactly as provided
          printf "%s\n" "$SSH_KEY" > ~/.ssh/prod_docker_key
          chmod 600 ~/.ssh/prod_docker_key

          # Write SSH config so DOCKER_HOST can reference a named host
          cat > ~/.ssh/config <<CFG
          Host prod-docker
            HostName ${SSH_HOST}
            User ${SSH_USER}
            Port ${SSH_PORT}
            IdentityFile ~/.ssh/prod_docker_key
            IdentitiesOnly yes
            PubkeyAuthentication yes
            StrictHostKeyChecking accept-new
          CFG

          # Prime known_hosts (optional, StrictHostKeyChecking accept-new will handle first connect)
          ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" >> ~/.ssh/known_hosts || true

          # Create a tarball with excludes to avoid copying VCS and CI folders
          TAR_FILE="/tmp/kc-plugin.tar.gz"
          tar -czf "$TAR_FILE" \
            --exclude .git \
            --exclude .gitea \
            --exclude .github \
            --exclude Notes \
            --exclude "*.yml" \
            --exclude "*.yaml" \
            --exclude "*.md" \
            .
          
          # Choose target path: prefer absolute plugin path; otherwise derive from HOST_WP_ROOT
          if [ -n "${HOST_ABS_PLUGIN_PATH}" ]; then
            echo "Deploying to absolute host path: ${HOST_ABS_PLUGIN_PATH}"
            REMOTE_PATH_DECL="PLUGIN_PATH=\"${HOST_ABS_PLUGIN_PATH%/}\""
          elif [ -n "${HOST_WP_ROOT}" ]; then
            echo "Deploying to host path relative to remote home: \$HOME/${HOST_WP_ROOT%/}/wp-content/plugins/konficastle-workshopwahl"
            REMOTE_PATH_DECL="PLUGIN_PATH=\$HOME/${HOST_WP_ROOT%/}/wp-content/plugins/konficastle-workshopwahl"
          else
            echo "Error: set PROD_HOST_ABS_PLUGIN_PATH (absolute) or PROD_HOST_WP_ROOT (relative)" >&2
            exit 1
          fi

          # Upload tarball to host home and extract
          scp -o StrictHostKeyChecking=accept-new -o IdentitiesOnly=yes -i ~/.ssh/prod_docker_key "$TAR_FILE" prod-docker:~/kc-plugin.tar.gz
          # Use \$HOME for remote expansion (tilde does not expand inside quotes)
          ssh prod-docker "$REMOTE_PATH_DECL; mkdir -p \"\$PLUGIN_PATH\" && rm -rf \"\$PLUGIN_PATH\"/* && tar -xzf \"\$HOME/kc-plugin.tar.gz\" -C \"\$PLUGIN_PATH\" && rm -f \"\$HOME/kc-plugin.tar.gz\" && ls -la \"\$PLUGIN_PATH\" | head -n 50"