name: CI/CD

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

# Pinned so every run targets the same project regardless of the runner's
# checkout path — otherwise `docker compose` would derive the project name
# from the checkout directory, potentially spinning up a second stack and
# losing the `pgdata` volume instead of updating the running one. Must be
# `ruvdstest` (no trailing "s") to match the project name the live stack was
# actually deployed under — a one-letter mismatch here previously made
# Compose treat it as an unrelated project and spin up a whole second stack
# from scratch instead of recognizing and updating the running containers.
#
# JWT_SECRET/POSTGRES_PASSWORD come from Gitea's own Actions secrets store
# rather than the `.env` file DEPLOY.md has the human create in
# `/opt/ruvdstests` — the job checks out into the runner's own workspace, not
# that directory, so there's no `.env` for `docker compose` to read here.
# Must match the values already in that `.env` file: on `Deploy` this
# `docker compose up -d` targets the same running project (via
# COMPOSE_PROJECT_NAME above), and a different POSTGRES_PASSWORD than what
# the live `pgdata` volume was initialized with breaks the DB connection.
env:
  COMPOSE_PROJECT_NAME: ruvdstest
  JWT_SECRET: ${{ secrets.JWT_SECRET }}
  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

jobs:
  build-test-deploy:
    runs-on: host
    steps:
      # `runs-on: host` runs every step directly on the bare runner
      # container instead of spinning up a fresh container per job, and
      # `actions/checkout` below is a JS action — it needs a `node` binary
      # on PATH to run at all, which this image doesn't ship. Has to come
      # before Checkout, since Checkout itself is what fails without it.
      - name: Install Node.js
        shell: bash
        run: apk add --no-cache nodejs

      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      # The runner image ships bare (no Docker CLI, no .NET) — it only has
      # the host's Docker *socket* mounted (DooD), so both are installed
      # fresh each run rather than baking a custom runner image.
      - name: Install Docker CLI and .NET SDK
        shell: bash
        run: |
          apk add --no-cache docker-cli docker-cli-compose bash curl \
            icu-libs krb5-libs libgcc libintl libssl3 libstdc++ zlib ca-certificates
          curl -sSL https://dot.net/v1/dotnet-install.sh -o dotnet-install.sh
          bash dotnet-install.sh --channel 9.0 --install-dir /usr/share/dotnet
          ln -sf /usr/share/dotnet/dotnet /usr/local/bin/dotnet

      - name: Run Domain unit tests
        shell: bash
        run: dotnet test tests/Domain.Tests/Domain.Tests.fsproj -c Release

      - name: Build images
        shell: bash
        run: docker compose build

      - name: Deploy (master only)
        if: github.ref == 'refs/heads/master'
        shell: bash
        run: docker compose up -d