name: Deploy to WordPress

on:
  push:
    branches: [ main ]

permissions:
  contents: write

concurrency:
  group: deploy-production
  cancel-in-progress: true

jobs:
  test:
    name: Pre-deploy tests
    uses: ./.github/workflows/ci.yml

  validate:
    name: Validate deployment
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - name: Verify required files exist
        run: |
          for file in peptide-search-ai.php includes/ assets/ readme.txt; do
            [ -e "$file" ] && echo "✓ $file" || { echo "❌ Missing: $file"; exit 1; }
          done
      - name: Verify PSA_VERSION constant
        run: |
          if grep -q "define( 'PSA_VERSION'" peptide-search-ai.php; then
            version=$(grep "define( 'PSA_VERSION'" peptide-search-ai.php | sed "s/.*'\([^']*\)'.*/\1/")
            echo "✓ PSA_VERSION: $version"
          else
            echo "❌ PSA_VERSION not found"; exit 1
          fi
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.1'
      - name: Validate PHP syntax
        run: find . -name '*.php' -not -path './vendor/*' -print0 | xargs -0 -n1 php -l > /dev/null

  deploy-staging:
    name: Deploy to Staging
    needs: [test, validate]
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
      - name: Deploy via rsync → staging
        run: |
          rsync -avz --delete \
            --exclude='.git' --exclude='.github' \
            --exclude='ARCHITECTURE.md' --exclude='CONVENTIONS.md' --exclude='CHANGELOG.md' \
            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new" \
            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/staging/wp-content/plugins/peptide-search-ai/
      - name: Staging health check
        run: |
          sleep 5
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.peptiderepo.com/ || echo "000")
          echo "Staging responded: HTTP $STATUS"
      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key

  smoke:
    name: Smoke tests (staging)
    needs: deploy-staging
    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
    secrets:
      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

  sync-deploy-branch:
    name: Sync deploy branch
    runs-on: ubuntu-latest
    needs: [test, validate, deploy-staging, smoke]
    environment: production
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Sync deploy branch
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git fetch origin deploy:deploy 2>/dev/null || true
          if git rev-parse --verify deploy >/dev/null 2>&1; then
            git checkout deploy
          else
            git checkout --orphan deploy
            git rm -rf --cached . > /dev/null 2>&1 || true
          fi
          git rm -rf . > /dev/null 2>&1 || true
          git checkout main -- \
            assets/ \
            includes/ \
            peptide-search-ai.php \
            readme.txt
          git add -A
          if git diff-index --quiet HEAD -- 2>/dev/null; then
            echo "No changes to deploy."
          else
            git commit -m "Deploy ${GITHUB_SHA::7} from main"
          fi
          git push origin deploy

  deploy:
    name: Deploy to Hostinger
    runs-on: ubuntu-latest
    needs: sync-deploy-branch
    environment: production
    steps:
      - name: Pull deploy branch on Hostinger
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT }}
          script_stop: true
          envs: DEPLOY_KEY
          script: |
            mkdir -p ~/.ssh
            ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
            if [ ! -f ~/.ssh/deploy_key ]; then
              echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
              chmod 600 ~/.ssh/deploy_key
            fi
            if ! grep -q "github.com" ~/.ssh/config 2>/dev/null; then
              cat >> ~/.ssh/config <<'SSHEOF'
            Host github.com
              IdentityFile ~/.ssh/deploy_key
              StrictHostKeyChecking no
            SSHEOF
              chmod 600 ~/.ssh/config
            fi
            PLUGIN_DIR="$HOME/domains/peptiderepo.com/public_html/wp-content/plugins/peptide-search-ai"
            REPO_URL="git@github.com:peptiderepo/peptide-search-ai.git"
            if [ -d "$PLUGIN_DIR/.git" ]; then
              cd "$PLUGIN_DIR"
              git fetch origin deploy
              git reset --hard origin/deploy
            else
              rm -rf "$PLUGIN_DIR"
              git clone -b deploy "$REPO_URL" "$PLUGIN_DIR"
            fi
            echo "Deployed to $PLUGIN_DIR"
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
      - name: HTTP health check
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 "https://peptiderepo.com/")
          if [ "$STATUS" -eq 200 ] || [ "$STATUS" -eq 403 ]; then
            echo "✓ Production healthy (HTTP $STATUS)"
          else
            echo "⚠ Unexpected HTTP $STATUS"; exit 1
          fi
      - name: Deploy summary
        run: |
          echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY
          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Deployed to:** peptiderepo.com" >> $GITHUB_STEP_SUMMARY