---
name: Validate and deploy

on:
  pull_request:
    branches:
      - main
    types:
      - opened
      - synchronize
      - reopened
      - closed

jobs:
  validate-and-deploy:
    runs-on: docker
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}

    steps:
      - name: Check out repository
        uses: https://data.forgejo.org/actions/checkout@v6

      - name: Scan secrets
        run: gitleaks detect --source . --redact --no-banner

      - name: Check Terraform formatting
        run: terraform fmt -check -recursive

      - name: Initialize Terraform
        run: terraform init -backend=false -input=false

      - name: Validate Terraform
        run: terraform validate

      - name: Plan Terraform
        run: terraform plan -input=false -no-color -out=tfplan

      - name: Lint Ansible
        run: ansible-lint deploy/site.yml

      - name: Deploy
        if: ${{ forgejo.event.action == 'closed' && forgejo.event.pull_request.merged == true }}
        env:
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
        run: bash deploy/deploy.sh