name: Reusable Deploy (staging → smoke → production)

# Single shared deploy pipeline for every peptiderepo plugin and the theme.
# Callers pass `target_path` (the wp-content subpath) and `secrets: inherit`,
# and the deploy logic lives HERE — fix it once instead of in six copy-pasted
# per-repo deploy.yml files (the drift that broke every deploy in May 2026).
#
# Staging deploy → smoke (informational) → production deploy (env-gated) with a
# pre/post active-plugin-count guard (the 2026-04-23 WP-core-clobber tripwire),
# LiteSpeed purge, and a health check.

on:
  workflow_call:
    inputs:
      target_path:
        description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger or wp-content/themes/peptide-starter"
        required: true
        type: string
      run_smoke:
        description: "Run the staging smoke suite (informational; never gates prod)"
        required: false
        default: true
        type: boolean
    secrets:
      SSH_PRIVATE_KEY:
        required: true
      SSH_HOST:
        required: true
      SSH_PORT:
        required: true
      SSH_USERNAME:
        required: true
      STAGING_WP_ADMIN_USER:
        required: false
      STAGING_WP_ADMIN_PASSWORD:
        required: false

permissions:
  contents: read

jobs:
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - name: Deploy via rsync → staging
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
          BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
          rsync -avz --delete \
            --exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
            ./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/staging/${{ inputs.target_path }}/"
      - name: Staging health check
        run: |
          sleep 5
          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key

  smoke:
    name: Smoke tests (staging)
    needs: deploy-staging
    if: ${{ inputs.run_smoke }}
    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
    secrets:
      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

  deploy-production:
    name: Deploy to Production
    needs: [deploy-staging]   # smoke is informational; not a prod gate
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - name: Deploy via rsync → production (plugin-inventory guard)
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
          BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
          SSHC="ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}"
          PRE=$($SSHC "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" || echo 0)
          echo "Pre-deploy active plugins: $PRE"
          rsync -avz --delete \
            --exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
            ./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/${{ inputs.target_path }}/"
          POST=$($SSHC "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" || echo 0)
          echo "Post-deploy active plugins: $POST"
          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
            echo "ERROR: active plugin count dropped ${PRE} -> ${POST} after deploy — aborting as failed."
            exit 1
          fi
          $SSHC "cd $BASE && find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true"
          echo "LiteSpeed cache purged."
      - name: Production health check
        run: |
          sleep 5
          S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
          if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "ERROR: site returned HTTP $S"; exit 1; fi
          echo "Production healthy (HTTP $S)"
      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key
      - name: Deploy summary
        run: |
          echo "## Deployment complete" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Target:** ${{ inputs.target_path }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> "$GITHUB_STEP_SUMMARY"