name: Docker Compose Deploy

on:
  push:
    branches:
      - main
  # Manual re-run, for redeploying after a rollback or re-creating the
  # workspace .env that the cleanup step below now removes.
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build_and_deploy:
    runs-on: [self-hosted, linux]
    # SEC-01: this gates nothing until required reviewers are configured on the
    # "production" environment itself. See the pull request description.
    environment: production

    steps:
      - name: Checkout code
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          clean: true
          fetch-depth: 1

      - name: Create environment file
        working-directory: ${{ github.workspace }}
        env:
          DOT_ENV: ${{ secrets.DOT_ENV }}
        run: |
          if [ -z "$DOT_ENV" ]; then
            echo "DOT_ENV secret is missing or empty."
            exit 1
          fi

          umask 077
          printf '%s\n' "$DOT_ENV" > .env

      - name: Build and deploy
        working-directory: ${{ github.workspace }}
        run: |
          sudo docker compose up -d --build --force-recreate
          echo "Container created."

      # `docker compose up -d` exits 0 once the container is created, not once the
      # program inside is running. The bot can panic at boot (a bad .env value, a
      # Supabase hiccup) and exit within a second while the deploy still goes green.
      # Assert the container is actually alive, and surface its logs if not (OPS-04).
      - name: Verify the bot is still running
        working-directory: ${{ github.workspace }}
        run: |
          sleep 30
          id=$(sudo docker compose ps -q dsec_bot)
          running=$(sudo docker inspect -f '{{.State.Running}}' "$id")
          if [ "$running" != "true" ]; then
            echo "::error::dsec_bot is not running 30s after deploy"
            sudo docker compose logs --tail=100 dsec_bot
            exit 1
          fi
          echo "Deployment complete."

      - name: Remove environment file
        if: always()
        working-directory: ${{ github.workspace }}
        run: rm -f .env

      - name: Clean up old Docker images
        run: sudo docker image prune -f