name: ci

on:
  push:
    branches: [main]

# Two pushes in a row must not deploy over each other.
concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false

env:
  IMAGE: git.example.com/youruser/hello-ops

jobs:
  test:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - run: npm test

  build:
    needs: test
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      # The job image has node (it must -- actions are JavaScript) but no docker
      # client. One static binary, no package manager, no daemon.
      - name: Get a docker client
        run: |
          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-29.7.2.tgz \
            | tar xz -C /usr/local/bin --strip-components=1 docker/docker
          docker version --format "{{.Client.Version}}"
      - name: Log in to our own registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.example.com -u youruser --password-stdin
      - name: Build and push
        run: |
          TAG=${GITHUB_SHA::7}
          docker build --build-arg APP_VERSION=$TAG -t $IMAGE:$TAG -t $IMAGE:latest .
          docker push $IMAGE:$TAG
          docker push $IMAGE:latest

  deploy:
    needs: build
    runs-on: docker
    steps:
      - name: Deploy over a key that can only do one thing
        run: |
          install -m 700 -d ~/.ssh
          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh -o StrictHostKeyChecking=no deploy@${{ secrets.DEPLOY_HOST }} ${GITHUB_SHA::7}