name: site

on:
  release:
    types: [published]
  push:
    branches:
      - master
    paths:
      - ".github/workflows/ci-site.yml"
      - "site/**"
      - "!**/CLAUDE.md"
      - "!site/README.md"
  pull_request:
    paths:
      - ".github/workflows/ci-site.yml"
      - "site/**"
      - "!**/CLAUDE.md"
      - "!site/README.md"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Build site image (pull request)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: set up docker buildx
        uses: docker/setup-buildx-action@v4

      - name: build image without pushing
        uses: docker/build-push-action@v7
        with:
          context: ./site
          load: true
          push: false
          cache-from: |
            type=gha,scope=site-pr
            type=gha,scope=site-linux/amd64
          cache-to: type=gha,scope=site-pr,mode=max,ignore-error=true

  build:
    name: Build site image (${{ matrix.platform }})
    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
            artifact: linux-amd64
          - platform: linux/arm64
            runner: ubuntu-24.04-arm
            artifact: linux-arm64

    steps:
      - name: checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: ./site
          platforms: ${{ matrix.platform }}
          cache-from: type=gha,scope=site-${{ matrix.platform }}
          cache-to: type=gha,scope=site-${{ matrix.platform }},mode=max,ignore-error=true
          outputs: type=image,name=ghcr.io/umputun/remark42-site,push-by-digest=true,name-canonical=true,push=true

      - name: export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: upload digest
        uses: actions/upload-artifact@v7
        with:
          name: site-digests-${{ matrix.artifact }}
          path: /tmp/digests/*
          retention-days: 1

  merge:
    name: Create site multi-arch manifest
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: read
      packages: write

    steps:
      - name: download digests
        uses: actions/download-artifact@v8
        with:
          path: /tmp/digests
          pattern: site-digests-*
          merge-multiple: true

      - name: verify all digests present
        run: |
          expected=2
          actual=$(find /tmp/digests -maxdepth 1 -type f | wc -l)
          if [ "$actual" -ne "$expected" ]; then
            echo "Expected $expected digests, found $actual"
            ls -la /tmp/digests
            exit 1
          fi
          echo "All $expected digests present"

      - name: set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: login to ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.PKG_TOKEN }}

      - name: create manifest and push
        working-directory: /tmp/digests
        env:
          GITHUB_REF: ${{ github.ref }}
        run: |
          ref="$(echo ${GITHUB_REF} | cut -d'/' -f3)"
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            docker buildx imagetools create \
              -t ghcr.io/umputun/remark42-site:${ref} \
              -t ghcr.io/umputun/remark42-site:latest \
              $(printf 'ghcr.io/umputun/remark42-site@sha256:%s ' *)
          else
            docker buildx imagetools create \
              -t ghcr.io/umputun/remark42-site:${ref} \
              $(printf 'ghcr.io/umputun/remark42-site@sha256:%s ' *)
          fi

  deploy:
    name: Deploy site
    runs-on: ubuntu-latest
    needs: merge
    if: github.ref == 'refs/heads/master' || github.event_name == 'release'
    permissions: {} # only calls an external URL via curl, no GitHub API access needed

    steps:
      - name: trigger deployment
        env:
          UPDATER_KEY: ${{ secrets.UPDATER_KEY }}
        run: curl -sf https://jess.umputun.com/update/remark42-site/${UPDATER_KEY}