name: Deploy Admin Staging

# ─────────────────────────────────────────────────────────────────────────────
# Build + Deploy-Pipeline fuer rebreak-admin-staging.
#
# Pattern: identisch zu deploy-staging.yml (backend).
#   - Build laeuft auf GH-Runner (7 GB RAM, kein OOM-Risiko auf Hetzner CX23)
#   - Artifact wird via scp zum Server gepusht
#   - Server-Script deploy-admin-from-artifact.sh extrahiert + pm2 restart
#
# Trigger: push to main (immer, auch wenn nur admin-App-Code geaendert).
# Optimierung spaeter: paths-filter auf apps/admin/** um unnoetigen Builds zu
# vermeiden. Fuer jetzt: einfach + robust.
#
# Port: 3017 (staging). Subdomain: admin.staging.rebreak.org
# pm2-Service: rebreak-admin-staging
# ─────────────────────────────────────────────────────────────────────────────

on:
  push:
    branches: [main]
    paths:
      - "apps/admin/**"
      - "pnpm-lock.yaml"
      - ".github/workflows/deploy-admin-staging.yml"
  workflow_dispatch:

concurrency:
  group: deploy-admin-staging
  cancel-in-progress: false  # queueen, nicht canceln

permissions:
  contents: read

jobs:
  # ── 1. Build auf GitHub-Runner ──────────────────────────────────────────────
  build:
    name: Build admin (Nuxt SSR)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        # version wird aus package.json "packageManager"-Field gelesen (pnpm@10.23.0)

      - uses: actions/setup-node@v4
        with:
          node-version: 24.11.1  # exakt Hetzner-Version matchen
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build admin (Nuxt SSR)
        working-directory: apps/admin
        run: pnpm build

      - name: Tar artifact
        run: tar czf admin-output.tar.gz -C apps/admin/.output .

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: admin-output
          path: admin-output.tar.gz
          retention-days: 7

  # ── 2. Deploy: Artifact zum Hetzner pushen + extract + pm2 restart ──────────
  deploy:
    name: Deploy zu Hetzner
    needs: build
    runs-on: ubuntu-latest
    environment: staging  # selbes GitHub-Environment wie backend-deploy (shared secrets)
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: admin-output

      - name: Setup SSH
        env:
          SSH_PRIVATE_KEY: ${{ secrets.HETZNER_SSH_KEY }}
          SSH_HOST: ${{ vars.HETZNER_HOST }}
        run: |
          if [ -z "$SSH_PRIVATE_KEY" ] || [ -z "$SSH_HOST" ]; then
            echo "FATAL: HETZNER_SSH_KEY (secret) oder HETZNER_HOST (var) nicht gesetzt"
            exit 1
          fi
          echo "Deploying admin to host: $SSH_HOST"
          mkdir -p ~/.ssh
          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "$SSH_HOST" >> ~/.ssh/known_hosts

      - name: Upload artifact zu Hetzner
        env:
          SSH_HOST: ${{ vars.HETZNER_HOST }}
          SSH_USER: ${{ vars.HETZNER_USER }}
        run: |
          scp -i ~/.ssh/id_ed25519 admin-output.tar.gz \
            "$SSH_USER@$SSH_HOST:/srv/rebreak/apps/admin/.output-incoming.tar.gz"

      - name: Server-side deploy (extract + pm2 restart)
        env:
          SSH_HOST: ${{ vars.HETZNER_HOST }}
          SSH_USER: ${{ vars.HETZNER_USER }}
        run: |
          ssh -i ~/.ssh/id_ed25519 "$SSH_USER@$SSH_HOST" \
            'bash /srv/rebreak/scripts/deploy-admin-from-artifact.sh'

      - name: Health-Check (HTTP 3xx/200 = Server erreichbar)
        run: |
          sleep 5
          STATUS=$(curl -sS -o /dev/null -w '%{http_code}' \
            https://admin.staging.rebreak.org/ || echo "000")
          echo "admin.staging.rebreak.org/ -> HTTP $STATUS"
          if [ "$STATUS" = "000" ] || [ "$STATUS" = "502" ] || [ "$STATUS" = "503" ]; then
            echo "FAIL: admin-staging nicht erreichbar (HTTP $STATUS)"
            exit 1
          fi
