name: publish
run-name: Publishing the website with a surfer
on:
  push:
    branches:
      - main
  workflow_dispatch:

# One deploy at a time: `surfer deploy` swaps the site atomically, so two runs
# racing each other is not corruption, but it is a wasted build and the last
# swap wins.
concurrency:
  group: surfer-datacontroller-io
  cancel-in-progress: false

jobs:
  Build-and-publish:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      # Blocking gate, at CRITICAL only. `npm audit` fails on the severity you
      # name, so `--audit-level=low` (or the default) would stop every deploy
      # today: the Gatsby 5 tree carries ~100 advisories at low/moderate/high
      # that have no non-breaking fix, and publishing would simply never run.
      # Critical is the line worth stopping a deploy for, and the tree is clear
      # of it - keep it that way rather than gating on noise nobody will action.
      - name: Audit for critical vulnerabilities
        run: npm audit --audit-level=critical

      - name: Build
        run: npm run build

      # Deploy tooling pinned to an exact version: the workflow publishes
      # whatever is committed, and an unpinned `latest` would let a breaking or
      # compromised upstream release ship straight to the live site.
      #
      # `deploy` (v7) replaces the site atomically - it extracts to a staging
      # folder and swaps it in, so a failed upload leaves the current site
      # serving.  The v6 `put` this replaces was token authenticated and is
      # gone; v7 takes the Cloudron username plus an app password for this app.
      - name: Publish
        env:
          SURFER_PASSWORD: ${{ secrets.SURFER_PASSWORD }}
          REF_NAME: ${{ gitea.ref_name }}
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          npx --yes @cloudron/surfer@7.2.0 deploy public \
            --server datacontroller.io \
            --username allan \
            --password "$SURFER_PASSWORD" \
            --message "Build from ${REF_NAME} @ ${COMMIT_SHA:0:8}"