# ---------------------------------------------------------------------------
# REFERENCE ONLY. This repository lives on self-hosted Gitea (AGENTS.md D3).
# The live pipeline is .gitea/workflows/deploy.yml.
#
# This file is kept because it is the better design: GitHub OIDC issues a
# short-lived token per run instead of a static key. If the project ever moves
# to GitHub or GitLab, use this and delete the static IAM user.
# ---------------------------------------------------------------------------
name: Build and deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

# OIDC role assumption — no long-lived AWS credentials in this repository.
# See docs/06-deployment.md for the one-time IAM setup.
permissions:
  contents: read
  id-token: write

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install
        run: npm ci

      - name: Type and template check
        run: npm run check

      - name: Build
        run: npm run build
        env:
          PUBLIC_SITE_URL: https://adr.smlcompany.ca
          PUBLIC_INTAKE_ENDPOINT: ${{ vars.INTAKE_ENDPOINT }}
          PUBLIC_BOOKING_URL: ${{ vars.BOOKING_URL }}

      # TODO(pouya): AGENTS.md Q9, Q10 — set these repository variables:
      #   AWS_DEPLOY_ROLE_ARN, AWS_REGION, S3_BUCKET, CLOUDFRONT_DISTRIBUTION_ID
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      # Two passes: hashed immutable assets first, HTML last. A visitor must
      # never fetch a new page whose assets have not landed yet.
      - name: Sync hashed assets
        run: |
          aws s3 sync ./dist "s3://${{ vars.S3_BUCKET }}" \
            --exclude "*" \
            --include "_astro/*" --include "fonts/*" \
            --cache-control "public, max-age=31536000, immutable" \
            --no-progress

      - name: Sync images
        run: |
          aws s3 sync ./dist "s3://${{ vars.S3_BUCKET }}" \
            --exclude "*" \
            --include "*.avif" --include "*.webp" --include "*.jpg" \
            --include "*.png" --include "*.svg" \
            --cache-control "public, max-age=604800" \
            --no-progress

      - name: Sync HTML and the rest
        run: |
          aws s3 sync ./dist "s3://${{ vars.S3_BUCKET }}" \
            --exclude "_astro/*" --exclude "fonts/*" \
            --cache-control "public, max-age=0, must-revalidate" \
            --delete --no-progress

      - name: Invalidate CloudFront
        run: |
          aws cloudfront create-invalidation \
            --distribution-id "${{ vars.CLOUDFRONT_DISTRIBUTION_ID }}" \
            --paths "/*"

      - name: Summary
        run: echo "Deployed to https://adr.smlcompany.ca — commit ${GITHUB_SHA::7}" >> "$GITHUB_STEP_SUMMARY"