name: Deploy (dev)

# Auto-deploys main to the DEV environment (the exe.dev VM) after CI passes, plus on-demand
# runs. This is the always-current, testable live deployment. Production is separate and
# manual (deploy-production.yml). Config is rendered from the `dev` environment's + repo's
# Actions secrets/variables; the exe.dev-specific deploy lives in scripts/deploy/exedev.sh.
#
# DEPRECATED-PENDING-CUTOVER (M24-5): this compose path stays the LIVE deploy (exe.dev edge ->
# 8080) while deploy-k3s-dev.yml deploys the same SHA to the k3s cluster in parallel. Once k3s
# parity is verified and the edge flips to Traefik:80, this workflow is retired - runbook in
# docs/deployment.md ("Cutover runbook: compose -> k3s").
on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-dev
  cancel-in-progress: false

jobs:
  deploy:
    # Auto runs deploy only when CI succeeded; manual runs always proceed.
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: bloom-arc
    environment: dev
    # packages: read lets the VM pull the private GHCR image with the workflow token.
    permissions:
      contents: read
      packages: read
    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          # Deploy the exact commit CI built (its image is tagged by that SHA); fall back to main
          # tip for a manual dispatch.
          ref: ${{ github.event.workflow_run.head_sha || 'main' }}

      - name: Render .env from Actions secrets and variables
        env:
          SECRETS_JSON: ${{ toJSON(secrets) }}
          VARS_JSON: ${{ toJSON(vars) }}
        run: bash scripts/deploy/render-env.sh env.generated

      - name: Compute the image tag to deploy
        id: img
        run: echo "tag=sha-$(git rev-parse HEAD | cut -c1-12)" >> "$GITHUB_OUTPUT"

      - name: Deploy to the exe.dev VM
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          BLOOM_IMAGE_TAG: ${{ steps.img.outputs.tag }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash scripts/deploy/exedev.sh env.generated