name: Build & Deploy

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  build:
    runs-on: linux
    container: node:24
    steps:
      - name: Checkout repository
        run: git clone --depth=1 http://x-access-token:${{ github.token }}@192.168.1.39:3000/${{ github.repository }}.git .
        with:
          fetch-depth: 0

      - name: Install dependencies
        run: npm ci

      - name: Build project
        run: npm run build

  docker:
    needs: build
    runs-on: dind
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Checkout repository
        run: git clone --depth=1 http://x-access-token:${{ github.token }}@192.168.1.39:3000/${{ github.repository }}.git .

      - name: Login to Gitea Container Registry
        run: |
          echo "${{ secrets.token }}" | docker login http://192.168.1.39:3000 -u "${{ secrets.username }}" --password-stdin

      - name: Build and push Docker image
        run: |
          IMAGE=192.168.1.39:3000/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          docker build -t ${IMAGE}:latest -t ${IMAGE}:${{ github.sha }} .
          docker push ${IMAGE}:latest
          docker push ${IMAGE}:${{ github.sha }}

      # ---------------------------------------------------------------------
      # ⚠️ SECURITY REVIEW NOTES (see pc_builder remediation plan, item 1.4)
      # ---------------------------------------------------------------------
      # This deploy step has two known issues that were flagged during a
      # security review but intentionally NOT auto-fixed here (no access to
      # reconfigure the NAS SSH/sudo setup from this environment):
      #
      # 1. `.env.production` was removed from git tracking (it contained
      #    plaintext APP_KEY/DB_PASSWORD and should never have been
      #    committed). The `cat .env.production` line below now reads a
      #    file that will NOT exist in a fresh `git clone` of this repo,
      #    since this job clones the repo from scratch at the top of the
      #    `docker` job. This step WILL fail until the deployment secrets
      #    are migrated to Gitea Actions secrets and the `.env` file is
      #    generated at deploy time instead of committed, e.g.:
      #      printf 'APP_KEY=%s\nDB_PASSWORD=%s\n...' \
      #        "${{ secrets.APP_KEY }}" "${{ secrets.DB_PASSWORD }}" | \
      #        sshpass ... "cat > /volume1/docker/pc_builder/.env"
      #    Until that migration happens, whoever runs this pipeline must
      #    place a non-committed `.env.production` file back in the
      #    repository checkout (or update this script) for deploys to work.
      #
      # 2. The NAS password (`secrets.NASPASS`) is passed on the command
      #    line via `sshpass -p` and `sudo -S`, which can leak through
      #    process listings and CI logs. Recommended remediation: switch to
      #    a dedicated SSH key stored as a Gitea secret, and configure a
      #    scoped passwordless `sudo` (NOPASSWD) on the NAS limited to the
      #    exact commands below (setup-db.sh, docker compose, docker exec),
      #    rather than transiting the interactive user's password.
      - name: Deploy on NAS
        run: |
          apk add --no-cache openssh-client sshpass
          cat docker-compose.prod.yml | sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/pc_builder/docker-compose.prod.yml"
          cat .env.production | sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/pc_builder/.env"
          cat deploy/setup-db.sh | sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/pc_builder/setup-db.sh"
          sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "
            cd /volume1/docker/pc_builder &&
            echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/bash setup-db.sh &&
            echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/docker compose -f docker-compose.prod.yml pull &&
            echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/docker compose -f docker-compose.prod.yml up -d --remove-orphans &&
            echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/docker exec pc-builder node ace migration:run --force
          "