name: Test and deploy staging
on:
  push:
    branches: [staging]

jobs:
  staging:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Build once. The same SHA-tagged image stays on the deployment host for
      # one-click promotion to production; the production workflow never rebuilds it.
      - uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: git.stanrunge.dev/stan/personal-website:${{ github.sha }}
          build-args: |
            GIT_SHA=${{ github.sha }}

      - name: Configure deployment SSH key
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
        run: |
          set -euo pipefail
          install -d -m 700 ~/.ssh
          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H 172.17.0.1 >> ~/.ssh/known_hosts

      - name: Transfer tested image
        run: |
          set -euo pipefail
          image="git.stanrunge.dev/stan/personal-website:${{ github.sha }}"
          docker save "$image" | ssh -o BatchMode=yes deploy@172.17.0.1 'sudo docker load'

      - name: Deploy staging
        run: |
          set -euo pipefail
          ssh -o BatchMode=yes deploy@172.17.0.1 \
            "bash -s -- '${{ github.sha }}' '/opt/personal-website-staging' 'https://staging.stanrunge.dev'" \
            < scripts/deploy-remote.sh