name: Build & Deploy (Bun)

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy
  cancel-in-progress: false

permissions:
  contents: read

env:
  VPS_HOST: ${{ secrets.VPS_HOST }}
  VPS_USER: ${{ secrets.VPS_USER }}

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14

      - name: Install deps
        run: bun install --frozen-lockfile

      - name: Type-check
        run: bun run check

      - name: Test
        run: bun test

      - name: Build binary
        run: |
          bun run build
          test -x dist/zesdex && echo "binary OK ($(stat -c%s dist/zesdex) bytes)"

      - name: Setup SSH key
        if: env.VPS_HOST != '' && env.VPS_HOST != 'null'
        env:
          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          sed -i 's/\r$//' ~/.ssh/id_ed25519
          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Deploy zesdex to VPS
        if: env.VPS_HOST != '' && env.VPS_HOST != 'null'
        run: |
          scp dist/zesdex "$VPS_USER@$VPS_HOST:/usr/local/bin/zesdex"
          ssh "$VPS_USER@$VPS_HOST" "chmod +x /usr/local/bin/zesdex && systemctl restart zesdex"