name: Tests et déploiement

on:
  push:
    branches:
      - master

jobs:
  validate:
    runs-on: ci-node
    timeout-minutes: 30

    steps:
      - name: Récupérer le commit
        uses: https://github.com/actions/checkout@v4
        with:
          ref: ${{ gitea.sha }}
          persist-credentials: false

      - name: Installer et valider
        env:
          CI: "true"
        run: |
          set -eu
          npm ci
          npm run validate

      - name: Diagnostiquer le téléchargement Chromium
        timeout-minutes: 4
        run: |
          set -eu
          curl --fail --location \
            --connect-timeout 15 \
            --max-time 180 \
            --output /dev/null \
            --write-out '\nHTTP=%{http_code} destination=%{url_effective}\n' \
            'https://cdn.playwright.dev/builds/cft/156.0.8078.4/linux64/chrome-headless-shell-linux64.zip'

      - name: Installer Chromium pour les tests
        timeout-minutes: 20
        env:
          CI: "true"
          # Allow slow CDN connections; Playwright keeps its built-in retries.
          PLAYWRIGHT_DOWNLOAD_CONNECTION_TIMEOUT: "180000"
          DEBUG: "pw:install"
        run: |
          set -eu
          npx playwright install --with-deps --only-shell chromium

      - name: Valider les parcours navigateur et le mode hors ligne
        timeout-minutes: 5
        env:
          CI: "true"
        run: |
          set -eu
          npm run test:e2e

  deploy:
    needs: validate
    runs-on: ci-node
    timeout-minutes: 20

    steps:
      - name: Installer le client SSH
        run: |
          set -eu
          apt-get update
          apt-get install -y --no-install-recommends openssh-client

      - name: Déployer le commit validé
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
          SHA: ${{ gitea.sha }}
        run: |
          set -eu
          echo "Préparation de la connexion SSH"
          : "${DEPLOY_HOST:?Secret DEPLOY_HOST absent ou vide}"
          : "${DEPLOY_USER:?Secret DEPLOY_USER absent ou vide}"
          : "${DEPLOY_SSH_KEY:?Secret DEPLOY_SSH_KEY absent ou vide}"
          : "${DEPLOY_KNOWN_HOSTS:?Secret DEPLOY_KNOWN_HOSTS absent ou vide}"
          : "${SHA:?SHA absent ou vide}"
          umask 077
          mkdir -p "$HOME/.ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy"
          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"

          trap 'rm -f "$HOME/.ssh/deploy"' EXIT

          ssh \
            -i "$HOME/.ssh/deploy" \
            -o IdentitiesOnly=yes \
            -o BatchMode=yes \
            -o StrictHostKeyChecking=yes \
            -o ConnectTimeout=10 \
            -o UserKnownHostsFile="$HOME/.ssh/known_hosts" \
            "$DEPLOY_USER@$DEPLOY_HOST" \
            "echo SSH_OK; bash /opt/pardis/deploy.sh '$SHA'"