name: Deploy Hugo Site

on:
  workflow_call:
    inputs:
      workflow_name:
        description: Display name for the caller workflow
        required: false
        default: Deploy
        type: string
      checkout_submodules:
        description: Whether checkout should fetch submodules recursively
        required: false
        default: false
        type: boolean
      deploy_script:
        description: Path to the repo-local deploy script
        required: false
        default: ./scripts/deploy.sh
        type: string
      deploy_ssh_host:
        description: Deployment SSH host
        required: false
        default: ""
        type: string
      deploy_ssh_user:
        description: Deployment SSH user
        required: false
        default: ""
        type: string

jobs:
  deploy:
    name: ${{ inputs.workflow_name }}
    timeout-minutes: 20
    runs-on: develton-hugo
    defaults:
      run:
        shell: bash
    env:
      PATH: /snap/hugo/current/bin:/usr/local/bin:/usr/bin:/bin:/snap/bin
      DEPLOY_SSH_HOST: ${{ inputs.deploy_ssh_host != '' && inputs.deploy_ssh_host || vars.DEPLOY_SSH_HOST }}
      DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
      DEPLOY_SSH_USER: ${{ inputs.deploy_ssh_user != '' && inputs.deploy_ssh_user || vars.DEPLOY_SSH_USER }}
      DEPLOY_KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
      DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
      HUGO_PARAMS_ANALYTICS_GOOGLE_SITEVERIFICATIONTAG: ${{ vars.GOOGLE_SITE_VERIFICATION_TAG }}
      HUGO_PARAMS_TURNSTILESITEKEY: ${{ vars.TURNSTILE_SITE_KEY }}
      HUGO_WORKER_URL: ${{ vars.HUGO_WORKER_URL }}
    steps:
      - name: Checkout repository
        uses: https://data.forgejo.org/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          submodules: ${{ inputs.checkout_submodules && 'recursive' || 'false' }}

      - name: Validate deploy configuration
        env:
          DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}
        run: |
          set -euo pipefail
          missing=()
          [[ -n "${DEPLOY_SSH_HOST:-}" ]] || missing+=("DEPLOY_SSH_HOST")
          [[ -n "${DEPLOY_SSH_USER:-}" ]] || missing+=("DEPLOY_SSH_USER")
          [[ -n "${DEPLOY_PATH:-}" ]] || missing+=("DEPLOY_PATH")
          [[ -n "${DEPLOY_SSH_KEY:-}" ]] || missing+=("DEPLOY_SSH_KEY")
          if (( ${#missing[@]} > 0 )); then
            printf 'Missing required deploy settings: %s\n' "${missing[*]}" >&2
            exit 1
          fi

      - name: Write deploy key
        env:
          DEPLOY_SSH_KEY: ${{ secrets.deploy_ssh_key }}
        run: |
          set -euo pipefail
          install -d -m 0700 "$HOME/.ssh"
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
          chmod 0600 "$HOME/.ssh/deploy_key"

      - name: Add deploy host to known_hosts
        run: |
          set -euo pipefail
          install -d -m 0700 "$HOME/.ssh"
          if [[ -n "${DEPLOY_KNOWN_HOSTS:-}" ]]; then
            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          else
            ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}" "${DEPLOY_SSH_HOST}" > "$HOME/.ssh/known_hosts"
          fi
          chmod 0600 "$HOME/.ssh/known_hosts"

      - name: Run deploy script
        run: |
          set -euo pipefail
          test -x "${{ inputs.deploy_script }}" || chmod +x "${{ inputs.deploy_script }}"
          export SSH_IDENTITY_FILE="$HOME/.ssh/deploy_key"
          export SSH_KNOWN_HOSTS_FILE="$HOME/.ssh/known_hosts"
          "${{ inputs.deploy_script }}"

      - name: Remove deploy key
        if: ${{ always() }}
        run: rm -f "$HOME/.ssh/deploy_key"