name: Deploy

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    # The runner lives on the same host as Gitea: a hang used to sit here for hours.
    timeout-minutes: 15
    steps:
      - name: Checkout
        run: |
          git config --global --add safe.directory '*'
          # Clone over the LAN, not through the public hostname. Measured 2026-10-16:
          # git.hoelee.com goes out to Cloudflare and back through the tunnel at
          # ~16 KB/s (13 min for a shallow clone, once hung for 13+ min mid-pack),
          # while http://192.168.1.6:3000 serves the same archive at ~17 MB/s.
          # Gitea has no 443 on the LAN, so this hop is plain HTTP on the private
          # network — the token never leaves the LAN.
          git clone --depth 1 "http://hoelee:${{ secrets.PAT }}@192.168.1.6:3000/hoelee/hoelee-blog.git" .
          git checkout $GITHUB_SHA 2>/dev/null || true

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Deploy to nginx-hoelee-blog
        run: |
          rm -rf /mnt/user/docker/nginx-hoelee-blog/html/*
          cp -r dist/* /mnt/user/docker/nginx-hoelee-blog/html/
          echo "Deployed. Contents:"
          ls -la /mnt/user/docker/nginx-hoelee-blog/html/

      # Purge the Cloudflare edge after deploy. Required as soon as an HTML cache
      # rule exists at the edge (Caching -> Cache Rules): without a purge, a new or
      # edited post can keep serving the old HTML until the Edge TTL expires.
      # Skipped silently while the secrets are unset so the deploy never breaks.
      - name: Purge Cloudflare cache
        run: |
          if [ -z "${CF_TOKEN}" ] || [ -z "${CF_ZONE_ID}" ]; then
            echo "CF_TOKEN / CF_ZONE_ID not set — skipping purge (add both as repo secrets)"
            exit 0
          fi
          echo "Purging zone ${CF_ZONE_ID} ..."
          # -m 30: a hung purge API must never hold the deploy open.
          curl -sS -m 30 -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \
            -H "Authorization: Bearer ${CF_TOKEN}" \
            -H "Content-Type: application/json" \
            --data '{"purge_everything":true}' | head -c 400 || echo "purge call failed (deploy already done)"
          echo
        env:
          CF_TOKEN: ${{ secrets.CF_TOKEN }}
          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}