# Deploy makefuture.ro to the web box.
#
# Runs on the `web-box` runner, which lives on the deploy target itself. The
# job still connects over SSH rather than touching the filesystem directly:
# scripts/deploy.sh is the same script used by hand from a laptop, and having
# CI take a different path to the same box is how the two quietly diverge.

stages:
  - deploy

deploy:
  stage: deploy
  image: alpine:3.20

  rules:
    # Only main. Branches and merge requests build nothing, because there is
    # nothing to build — this is a static site with no test suite to run.
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

  # One deploy at a time. Two overlapping pipelines would race on the `current`
  # symlink and could leave it pointing at the older of the two releases.
  resource_group: deploy

  variables:
    # deploy.sh needs a real commit SHA for the release directory name, and
    # GitLab's default shallow clone is enough for `git rev-parse HEAD`.
    GIT_DEPTH: '10'

  before_script:
    - apk add --no-cache bash git rsync openssh-client curl
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    # DEPLOY_SSH_KEY is meant to be a File-type CI/CD variable, in which case
    # this expands to a path. Accepting the plain-variable form too costs one
    # branch and saves an afternoon: pasted into the wrong box, a key otherwise
    # fails later and much less obviously, as a malformed-key SSH error.
    - |
      if [ -f "$DEPLOY_SSH_KEY" ]; then
        cp "$DEPLOY_SSH_KEY" ~/.ssh/id_ed25519
      else
        printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
      fi
    - chmod 600 ~/.ssh/id_ed25519
    - ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null

  script:
    - ./scripts/deploy.sh

  # deploy.sh verifies itself over real HTTPS and exits non-zero if any page or
  # the WebSocket handshake fails, so a red pipeline here means the site is
  # actually broken — not merely that a step was skipped.