name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy over SSH
        uses: appleboy/ssh-action@v1.2.5
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_PORT }}
          script: |
            set -e
            cd ${{ secrets.DEPLOY_PATH }}
            git fetch --prune origin
            git reset --hard origin/main
            bash deploy.sh main

      - name: Smoke check (HTTP 2xx/3xx)
        env:
          URL: ${{ secrets.DEPLOY_URL }}
        run: |
          if [ -z "$URL" ]; then echo "DEPLOY_URL non defini - smoke check ignore"; exit 0; fi
          code=$(curl -sS -o /dev/null -w "%{http_code}" -L --max-time 30 --retry 2 "$URL")
          echo "HTTP $code - $URL"
          case "$code" in 2*|3*) echo "site OK";; *) echo "smoke check echoue (HTTP $code)"; exit 1;; esac
