name: Deploy (production)

# Manual-only production deploy/rollback (Actions tab -> Deploy (production) -> Run workflow).
# Production runs the same build-once, deploy-many mechanism as dev: pick an image tag to deploy,
# or roll back to the previously-good tag. The provider-specific logic lives in
# scripts/deploy/production.sh, so switching providers is a script change, not a workflow change.
# Config is rendered from the `production` environment's + repo's Actions secrets/variables - put
# production-specific overrides (bot token, database, domain, ...) on the `production` environment.
on:
  workflow_dispatch:
    inputs:
      mode:
        description: "deploy a tag, or roll back to the previous one"
        type: choice
        options: [deploy, rollback]
        default: deploy
      image_tag:
        description: "Image tag to deploy, e.g. sha-abc123def456 (required for deploy; ignored for rollback)"
        type: string
        required: false

concurrency:
  group: deploy-production
  cancel-in-progress: false

permissions:
  contents: read
  packages: read

jobs:
  deploy:
    runs-on: bloom-arc
    environment: production
    steps:
      - name: Check out source
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Render .env from Actions secrets and variables
        env:
          SECRETS_JSON: ${{ toJSON(secrets) }}
          VARS_JSON: ${{ toJSON(vars) }}
        run: bash scripts/deploy/render-env.sh env.generated

      - name: Deploy or roll back production (by tag)
        env:
          MODE: ${{ inputs.mode }}
          BLOOM_IMAGE_TAG: ${{ inputs.image_tag }}
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Provider creds for the production target (a VM over SSH today) live on the
          # `production` environment; empty until production infra is configured.
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: bash scripts/deploy/production.sh env.generated