name: Rollback Deployment

on:
  workflow_dispatch:
    inputs:
      commit_sha:
        description: 'Commit SHA to deploy (leave empty for last green commit)'
        required: false
        type: string

permissions:
  contents: read
  deployments: write

jobs:
  rollback:
    name: Rollback to specified commit
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine target commit
        id: target
        run: |
          if [ -n "${{ github.event.inputs.commit_sha }}" ]; then
            TARGET_SHA="${{ github.event.inputs.commit_sha }}"
          else
            # Use the most recent commit
            TARGET_SHA=$(git rev-parse HEAD)
          fi
          echo "commit_sha=${TARGET_SHA:0:7}" >> $GITHUB_OUTPUT
          echo "commit_full=${TARGET_SHA}" >> $GITHUB_OUTPUT

      - name: Validate commit exists
        run: |
          if ! git cat-file -e ${{ steps.target.outputs.commit_full }}^{commit} 2>/dev/null; then
            echo "ERROR: Commit ${{ steps.target.outputs.commit_full }} not found"
            exit 1
          fi
          echo "Target commit found: ${{ steps.target.outputs.commit_full }}"

      - name: Build deploy branch from target commit
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Fetch the remote deploy branch (may not exist).
          git fetch origin deploy:deploy 2>/dev/null || true

          # Check out deploy branch or create it.
          if git rev-parse --verify deploy >/dev/null 2>&1; then
            git checkout deploy
          else
            git checkout --orphan deploy
            git rm -rf --cached . > /dev/null 2>&1 || true
          fi

          # Remove all tracked files.
          git rm -rf . > /dev/null 2>&1 || true

          # Checkout only the plugin runtime files from the target commit.
          git checkout ${{ steps.target.outputs.commit_full }} -- \
            admin/ \
            includes/ \
            languages/ \
            public/ \
            peptide-news-plugin.php \
            uninstall.php

          # Commit only if there are actual changes.
          git add -A
          if git diff-index --quiet HEAD -- 2>/dev/null; then
            echo "No changes to deploy (already at target commit)."
          else
            git commit -m "Rollback to ${{ steps.target.outputs.commit_sha }} from ${{ github.ref_name }}"
          fi

          # Normal push (fast-forward).
          git push origin deploy

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          if [ -n "${{ secrets.KNOWN_HOSTS }}" ]; then
            echo "${{ secrets.KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
          else
            ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
          fi

      - name: Deploy via rsync
        run: |
          rsync -avz --delete \
            --exclude='.git' \
            --exclude='.github' \
            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-news-plugin/

      - name: Purge LiteSpeed Cache
        if: success()
        run: |
          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new \
            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
            CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
            if [ -d "$CACHE_DIR" ]; then
              rm -rf "$CACHE_DIR"/*
              echo "LiteSpeed cache purged."
            fi
            touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
            echo "Cache purge signal sent."
          ENDSSH

      - name: Cleanup SSH key
        if: always()
        run: rm -f ~/.ssh/deploy_key

      - name: Rollback summary
        run: |
          echo "## Rollback Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Rollback to commit:** \`${{ steps.target.outputs.commit_sha }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Method:** rsync from deploy branch to Hostinger" >> $GITHUB_STEP_SUMMARY
          echo "- **Deployed to:** ${{ secrets.WP_SITE_URL || 'peptiderepo.com' }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Timestamp:** $(date -u +'%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY