name: Deploy production
on:
  workflow_dispatch:

jobs:
  promote:
    runs-on: ubuntu-latest
    steps:
      # Always test the staging branch, regardless of which branch the button
      # appears on in Gitea's Actions UI.
      - uses: actions/checkout@v4
        with:
          ref: staging

      - name: Configure deployment SSH key
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
        run: |
          set -euo pipefail
          install -d -m 700 ~/.ssh
          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H 172.17.0.1 >> ~/.ssh/known_hosts

      - name: Promote the exact staging image
        run: |
          set -euo pipefail
          commit=$(git rev-parse HEAD)
          ssh -o BatchMode=yes deploy@172.17.0.1 "bash -s -- '$commit'" \
            < scripts/verify-staging-image.sh
          ssh -o BatchMode=yes deploy@172.17.0.1 \
            "bash -s -- '$commit' '/opt/personal-website' 'https://stanrunge.dev'" \
            < scripts/deploy-remote.sh