name: Build and Deploy

on:
  push:
    branches: [ "master" ]
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    # Pinned (not ubuntu-latest) to match the prod server's Ubuntu/glibc so the
    # compiled libchess_engine.so loads there. Keep this == the server's release.
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'  # adjust if needed
      - name: Restore
        run: dotnet restore JoshHeaps.Net/JoshHeaps.Net.csproj

      - name: Build native chess engine (libchess_engine.so)
        run: |
          cmake -S native/chess_engine -B native/chess_engine/build -DCMAKE_BUILD_TYPE=Release
          cmake --build native/chess_engine/build
          cp native/chess_engine/build/libchess_engine.so JoshHeaps.Net/Resources/

      - name: Publish
        run: dotnet publish JoshHeaps.Net/JoshHeaps.Net.csproj -c Release -o ./publish

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: site-publish
          path: ./publish

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: site-publish
          path: publish

      # GitHub artifacts don't preserve the Unix executable bit, so Stockfish (the only file
      # the app spawns as a subprocess) arrives non-executable. Restore 755 here; rsync -a then
      # carries it to the server, where the service user can run it regardless of file owner.
      - name: Restore Stockfish executable bit
        run: chmod 755 publish/Resources/stockfish-ubuntu-x86-64-sse41-popcnt

      - name: Prepare SSH
        run: |
          install -m 700 -d ~/.ssh
          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -p "${{ secrets.SSH_PORT || 22 }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts

      - name: Rsync to server
        run: |
          # --exclude chess-data: never let --delete remove the learned-engine training
          # data, which lives in the deploy dir unless ChessEngine__WeightsPath is set
          # elsewhere. publish/ never contains it, so without this --delete wipes it every deploy.
          rsync -az --delete --exclude 'chess-data' -e "ssh -p ${{ secrets.SSH_PORT || 22 }} -i ~/.ssh/id_rsa" \
            publish/ ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:${{ secrets.TARGET_DIR }}/

      - name: Reload and restart service
        run: |
          ssh -i ~/.ssh/id_rsa -p "${{ secrets.SSH_PORT || 22 }}" \
            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
            "sudo systemctl daemon-reload && sudo systemctl restart ${{ secrets.SERVICE_NAME }} && systemctl --no-pager status ${{ secrets.SERVICE_NAME }} --lines=0"