name: Fly Deploy

# Default-deny: scope GITHUB_TOKEN to read-only. Individual jobs can
# escalate via their own `permissions:` block if they need write access.
permissions: read-all

on:
  # SUPERSEDED 2026-05-31 — gluecron.com migrated off Fly.io to a dedicated
  # Vultr box that self-deploys by pulling from GitHub (see
  # scripts/standalone-deploy.sh). Manual dispatch only; no longer auto-fires.
  workflow_dispatch: {}

concurrency:
  group: fly-deploy-${{ github.ref }}
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy to Fly.io
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install flyctl
        run: |
          curl -fsSL https://github.com/superfly/flyctl/releases/download/v0.4.38/flyctl_0.4.38_Linux_x86_64.tar.gz -o /tmp/flyctl.tgz
          mkdir -p $HOME/.fly/bin
          tar -xzf /tmp/flyctl.tgz -C $HOME/.fly/bin
          echo "$HOME/.fly/bin" >> $GITHUB_PATH
          $HOME/.fly/bin/flyctl version

      - name: Ensure app exists
        run: |
          if ! flyctl apps list --json 2>/dev/null | grep -q '"Name":\s*"gluecron"'; then
            echo "Creating Fly app 'gluecron'..."
            flyctl apps create gluecron --org personal
          else
            echo "App 'gluecron' already exists."
          fi
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

      - name: Ensure volume exists
        continue-on-error: true
        run: |
          if ! flyctl volumes list -a gluecron --json 2>/dev/null | grep -qi '"name":\s*"gluecron_repos"'; then
            echo "Creating volume 'gluecron_repos' in iad..."
            flyctl volumes create gluecron_repos --app gluecron --size 3 --region iad --yes || \
              echo "Warning: volume creation failed (may already exist or account limit reached). Continuing."
          else
            echo "Volume 'gluecron_repos' already exists."
          fi
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

      - name: Sync application secrets to Fly
        run: |
          flyctl secrets set --app gluecron --stage \
            DATABASE_URL="$DATABASE_URL" \
            APP_BASE_URL="$APP_BASE_URL" \
            DEMO_SEED_ON_BOOT="$DEMO_SEED_ON_BOOT" \
            EMAIL_PROVIDER="$EMAIL_PROVIDER" \
            SITE_ADMIN_USERNAME="$SITE_ADMIN_USERNAME"
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          APP_BASE_URL: ${{ vars.APP_BASE_URL || 'https://gluecron.fly.dev' }}
          DEMO_SEED_ON_BOOT: ${{ vars.DEMO_SEED_ON_BOOT || '1' }}
          EMAIL_PROVIDER: ${{ vars.EMAIL_PROVIDER || 'log' }}
          SITE_ADMIN_USERNAME: ${{ vars.SITE_ADMIN_USERNAME || 'ccantynz-alt' }}

      - name: Deploy
        run: flyctl deploy --remote-only --app gluecron
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

      - name: Smoke test
        run: |
          sleep 10
          for i in 1 2 3 4 5; do
            code=$(curl -s -o /dev/null -w "%{http_code}" https://gluecron.fly.dev/healthz || echo "000")
            echo "Attempt $i: /healthz returned $code"
            if [ "$code" = "200" ]; then
              echo "Site is live."
              exit 0
            fi
            sleep 10
          done
          echo "Site did not respond with 200 after 50s. Check 'fly logs -a gluecron'."
          exit 1