# Tests every push; a push to rebuild (voyager 2) that passes is deployed to
# homelab.
#
# Deploying: the job SSHes to homelab with DEPLOY_SSH_KEY. That key may only
# run ~/bin/deploy-usenet-indexer (a forced command in authorized_keys),
# which passes "deploy-rebuild <sha>" on to ~/bin/deploy-usenet-rebuild
# (deploy/deploy.sh): it fetches the commit from this repo, builds the
# images, runs the migrations and recreates the app services (never
# postgres). See deploy/README.md.
name: Test and deploy

on:
  push:
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_USER: indexer
          POSTGRES_PASSWORD: indexer
          POSTGRES_DB: usenet_indexer
        options: >-
          --health-cmd "pg_isready -U indexer -d usenet_indexer"
          --health-interval 5s
          --health-retries 20
      redis:
        image: redis:8
    env:
      TZ: UTC
      PORT: 3333
      HOST: 0.0.0.0
      NODE_ENV: test
      LOG_LEVEL: warn
      APP_KEY: ci-only-app-key-not-a-secret-000000
      APP_URL: http://localhost:3333
      SESSION_DRIVER: memory
      DB_CONNECTION: pg
      DB_HOST: postgres
      DB_PORT: 5432
      DB_USER: indexer
      DB_PASSWORD: indexer
      DB_DATABASE: usenet_indexer
      REDIS_HOST: redis
      REDIS_PORT: 6379
      # Tests never connect to a news server.
      NNTP_HOST: localhost
      NNTP_PORT: 563
      NNTP_USER: ci
      NNTP_PASSWORD: ci
      NNTP_SECURE: true
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - name: Rust toolchain
        run: |
          command -v cargo || curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # The edge worker (edge/, Rust): built first, since the e2e suite runs edge/target/release/edge-node against
      # the node API; then its own tests, and the Rust and TypeScript RangeIndexers compared on the committed
      # captures (edge/fixtures).
      - name: Build the edge worker
        run: cargo build --release --manifest-path edge/Cargo.toml --bin edge-node
      - name: Type check
        run: npx tsc --noEmit
      - name: Migrate
        run: node ace migration:run --force
      - name: Test
        run: node ace test
      - name: cargo test
        run: cargo test --release --manifest-path edge/Cargo.toml
      - name: The Rust indexer over the fixtures
        run: edge/bench-fixtures.sh

  deploy:
    needs: [test]
    if: github.ref == 'refs/heads/rebuild'
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to homelab
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o BatchMode=yes \
            daan@10.206.0.175 "deploy-rebuild ${{ github.sha }}"