name: Release

on:
  push:
    tags: ["v*.*.*"]

permissions:
  contents: read
  packages: write

jobs:
  promote-and-deploy:
    runs-on: ubuntu-latest
    env:
      IMAGE: ghcr.io/whitehai11/anouma
    steps:
      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Pull tested image
        run: docker pull "$IMAGE:$GITHUB_SHA"
      - name: Promote release image
        env:
          VERSION: ${{ github.ref_name }}
        run: |
          docker tag "$IMAGE:$GITHUB_SHA" "$IMAGE:$VERSION"
          docker tag "$IMAGE:$GITHUB_SHA" "$IMAGE:latest"
          docker push "$IMAGE:$VERSION"
          docker push "$IMAGE:latest"
      - name: Deploy to production
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
          VERSION: ${{ github.ref_name }}
        shell: bash
        run: |
          set -euo pipefail
          umask 077
          key_file="$(mktemp)"
          known_hosts_file="$(mktemp)"
          trap 'rm -f "$key_file" "$known_hosts_file"' EXIT
          printf '%s\n' "$DEPLOY_SSH_KEY" > "$key_file"
          chmod 600 "$key_file"
          if [ -n "${DEPLOY_HOST_KEY:-}" ]; then
            printf '%s\n' "$DEPLOY_HOST_KEY" > "$known_hosts_file"
          else
            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > "$known_hosts_file" 2>/dev/null
          fi
          ssh -i "$key_file" -o UserKnownHostsFile="$known_hosts_file" -p "${DEPLOY_PORT:-22}" \
            "${DEPLOY_USER}@${DEPLOY_HOST}" "deploy ${VERSION}"