name: publish
run-name: Publishing the website with a surfer
on:
  push:
    branches:
      - main
  workflow_dispatch:

# One deploy at a time: `surfer deploy` swaps the site atomically, so two runs
# racing each other is not corruption, but it is a wasted build and the last
# swap wins.
concurrency:
  group: surfer-datacontroller-io
  cancel-in-progress: false

jobs:
  Build-and-publish:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      # Blocking gate. `npm audit --audit-level=<x>` is all-or-nothing and this
      # tree cannot pass a flat gate at any level: the Gatsby 5 build toolchain
      # carries ~100 advisories with no non-breaking fix, so gating on the tree
      # as a whole stops publishing permanently. scripts/audit-gate.mjs instead
      # accepts the known set (scripts/audit-baseline.json, with an owner and a
      # reason) and FAILS on any new critical/high advisory.
      - name: Audit for new critical/high advisories
        run: node scripts/audit-gate.mjs

      # The prettier and type checks used to live in a GitHub workflow that
      # never ran on this forge; keep them ahead of the build so a type or
      # formatting error blocks the deploy rather than shipping.
      - name: Typecheck
        run: npm run typecheck

      - name: Check prettier offences
        run: npm run lint

      - name: Build
        run: npm run build

      # Deploy tooling pinned to an exact version: the workflow publishes
      # whatever is committed, and an unpinned `latest` would let a breaking or
      # compromised upstream release ship straight to the live site.
      #
      # `deploy` (v7) replaces the site atomically - it extracts to a staging
      # folder and swaps it in, so a failed upload leaves the current site
      # serving.  The v6 `put` this replaces was token authenticated and is
      # gone; v7 takes the Cloudron username plus an app password for this app.
      - name: Publish
        env:
          SURFER_PASSWORD: ${{ secrets.SURFER_PASSWORD }}
          REF_NAME: ${{ gitea.ref_name }}
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          npx --yes @cloudron/surfer@7.2.0 deploy public \
            --server datacontroller.io \
            --username allan \
            --password "$SURFER_PASSWORD" \
            --message "Build from ${REF_NAME} @ ${COMMIT_SHA:0:8}"