name: deploy

on:
  push:
    branches: ["main"]

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          set -eux
          sudo apt-get update
          sudo apt-get install -y rsync openssh-client

      - name: Write SSH key and deploy
        env:
          HOST: ${{ secrets.DEPLOY_HOST }}
          USER: ${{ secrets.DEPLOY_USER }}
          DEST: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
        run: |
          set -euxo pipefail

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

          # Write the private key exactly as stored in the GitHub secret (preserves newlines)
          cat > ~/.ssh/id_ed25519 <<EOF
          $DEPLOY_KEY
          EOF
          chmod 600 ~/.ssh/id_ed25519

          # Validate key parses (fails fast if secret is malformed)
          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null

          # Trust the VM host key for this run
          ssh-keyscan -H "$HOST" >> ~/.ssh/known_hosts

          # Deploy repo contents to the destination directory on the VM
          rsync -az --delete \
            -e "ssh -i ~/.ssh/id_ed25519" \
            ./ "$USER@$HOST:$DEST/"