name: Deploy to web.hhivp.com

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          cat >> ~/.ssh/config <<EOF
          Host web
            HostName ${{ secrets.SSH_HOST }}
            User ${{ secrets.SSH_USER }}
            Port ${{ secrets.SSH_PORT }}
            IdentityFile ~/.ssh/deploy_key
            StrictHostKeyChecking accept-new
            UserKnownHostsFile ~/.ssh/known_hosts
          EOF

      - name: Deploy
        run: |
          ssh web 'bash -s' <<'REMOTE'
          set -euo pipefail
          cd /opt/docker/sites/anotherreflections-ru-v2
          git fetch --prune origin
          git reset --hard origin/main
          docker compose build --pull
          docker compose up -d
          # Чистка старых образов (CI/CD retention >7d по правилу проекта)
          docker image prune -af --filter "until=168h" >/dev/null 2>&1 || true
          REMOTE

      - name: Verify
        run: |
          ssh web 'curl -sf -H "Host: anotherreflections.ru" http://127.0.0.1:4084/ -o /dev/null -w "HTTP %{http_code} | %{size_download} bytes\n"'