name: Deploy Prod
description: >
  Deploy a commit of a *.podman infrastructure repo on its production host.
  Runs on that host's dedicated deploy runner (gitea-runner-deploy image):
  installs the deployment SSH key, reads the mounted deploy-target env file,
  and pipes the runner image's deploy-prod.sh to the host over SSH. Host key
  verification uses the known_hosts file mounted into the deploy runner.

inputs:
  deploy-target-file:
    description: >
      Path of the mounted deploy target env file, for example
      /run/noctrl/prod-deploy-target.env. Must define REPO_DIR, PROD_HOST,
      PROD_USER, PROD_PORT.
    required: true
  ssh-key-b64:
    description: Base64-encoded private SSH deploy key (PROD_DEPLOY_SSH_KEY secret).
    required: true
  target-sha:
    description: Commit SHA to deploy (normally github.sha).
    required: true

runs:
  using: composite
  steps:
    - id: install-key
      shell: bash
      env:
        SSH_KEY_B64: ${{ inputs.ssh-key-b64 }}
      run: |
        set -euo pipefail
        : "${SSH_KEY_B64:?missing ssh-key-b64 input (PROD_DEPLOY_SSH_KEY secret)}"
        install -d -m 0700 ~/.ssh
        printf '%s' "${SSH_KEY_B64}" | base64 -d > ~/.ssh/id_ed25519
        chmod 0600 ~/.ssh/id_ed25519
        ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null

    - id: deploy
      shell: bash
      env:
        TARGET_SHA: ${{ inputs.target-sha }}
        DEPLOY_TARGET_FILE: ${{ inputs.deploy-target-file }}
      run: |
        set -euo pipefail

        if [[ ! -f "${DEPLOY_TARGET_FILE}" ]]; then
          echo "missing mounted deploy target file: ${DEPLOY_TARGET_FILE}" >&2
          exit 1
        fi

        set -a
        . "${DEPLOY_TARGET_FILE}"
        set +a

        : "${REPO_DIR:?missing REPO_DIR in ${DEPLOY_TARGET_FILE}}"
        : "${PROD_HOST:?missing PROD_HOST in ${DEPLOY_TARGET_FILE}}"
        : "${PROD_USER:?missing PROD_USER in ${DEPLOY_TARGET_FILE}}"
        : "${PROD_PORT:?missing PROD_PORT in ${DEPLOY_TARGET_FILE}}"

        ssh \
          -o BatchMode=yes \
          -o IdentitiesOnly=yes \
          -i ~/.ssh/id_ed25519 \
          -p "${PROD_PORT}" "${PROD_USER}@${PROD_HOST}" \
          "REPO_DIR='${REPO_DIR}' bash -s -- '${TARGET_SHA}'" \
          < /usr/local/bin/deploy-prod.sh