# Catch broken content before it reaches a deploy.
#
# This workflow only builds and type-checks — it never touches the server.
# Deploying stays a deliberate local act (`npm run deploy`), which suits a site
# where publishing is a decision rather than a merge.
#
# If you later want pushes to main to publish automatically, see the commented
# job at the bottom.

name: check

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version-file: .nvmrc
          cache: npm

      - run: npm ci

      # Fails the build if any source photograph carries GPS coordinates.
      # Worth running here as well as locally: this is the last chance before
      # something reaches a machine you do not control.
      - name: Check photographs for location data
        run: npm run photos:check

      - name: Type-check
        run: npm run check

      - name: Build all four sites
        run: npm run build

      - name: Confirm every site produced output
        run: |
          for site in home blog fav io; do
            test -f "sites/$site/dist/index.html" \
              || { echo "::error::sites/$site produced no index.html"; exit 1; }
          done
          du -sh sites/*/dist

# ---------------------------------------------------------------------------
# Optional: deploy on push to main.
#
# Add the private half of ~/.ssh/id_ed25519_eratic as a repository secret named
# ERATIC_SSH_KEY, then uncomment. That key opens the personal-sites VPS and
# nothing else — deliberately not the key that reaches the Agora server.
#
#  deploy:
#    needs: build
#    runs-on: ubuntu-latest
#    if: github.ref == 'refs/heads/main'
#    steps:
#      - uses: actions/checkout@v5
#      - uses: actions/setup-node@v5
#        with:
#          node-version-file: .nvmrc
#          cache: npm
#      - run: npm ci
#      - name: Install deploy key
#        run: |
#          install -m 700 -d ~/.ssh
#          echo "${{ secrets.ERATIC_SSH_KEY }}" > ~/.ssh/id_ed25519_eratic
#          chmod 600 ~/.ssh/id_ed25519_eratic
#          ssh-keyscan -H 178.104.116.235 >> ~/.ssh/known_hosts
#      - run: ./deploy/deploy.sh