name: Deploy homelab (CT 116)

on:
  push:
    branches: [main]
  workflow_dispatch:

# CI already ran on the PR; main deploy is serialized and can take 15–30 min on axiom.
concurrency:
  group: deploy-homelab-main
  cancel-in-progress: true

jobs:
  deploy:
    name: Deploy to CT 116
    runs-on: [self-hosted, linux, axiom]
    timeout-minutes: 45

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Sync and deploy over SSH
        env:
          DEPLOY_HOST: ${{ secrets.HOMELAB_DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.HOMELAB_DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.HOMELAB_DEPLOY_PATH }}
          DEPLOY_SSH_KEY: ${{ secrets.HOMELAB_DEPLOY_SSH_KEY }}
        run: |
          set -euo pipefail
          if [[ -z "${DEPLOY_HOST:-}" || -z "${DEPLOY_USER:-}" || -z "${DEPLOY_SSH_KEY:-}" ]]; then
            echo "Skipping deploy: set HOMELAB_DEPLOY_HOST, HOMELAB_DEPLOY_USER, HOMELAB_DEPLOY_SSH_KEY repo secrets."
            exit 0
          fi
          deploy_path="${DEPLOY_PATH:-/opt/submatter}"
          mkdir -p ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "set -euo pipefail; cd '${deploy_path}' && bash scripts/git-sync-deploy.sh && bash scripts/deploy-prod.sh build"