name: Deploy Theme to Hostinger

on:
  push:
    branches: [main]

concurrency:
  group: deploy-peptide-starter-theme
  cancel-in-progress: true

jobs:
  validate:
    name: Validate PHP & JS
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: PHP Lint Check
        run: |
          find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
          test ${PIPESTATUS[0]} -eq 0
      - name: Install PHPCS with WordPress standards
        run: |
          composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
          composer global require --dev squizlabs/php_codesniffer:"^3.0" wp-coding-standards/wpcs:"^3.0" phpcsstandards/phpcsutils:"^1.0"
      - name: Run PHPCS (WordPress Core)
        run: |
          ~/.composer/vendor/bin/phpcs -s . || true  # non-blocking during theme rollout
      - name: JS Syntax Check
        run: |
          find assets/js -name "*.js" -exec node --check {} \;

  deploy-staging:
    name: Deploy to Staging
    needs: validate
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
      - name: Deploy via rsync → staging
        run: |
          rsync -avz --delete \
            --exclude='.git' \
            --exclude='.github' \
            --exclude='tests/' \
            --exclude='phpunit.xml' \
            --exclude='composer.json' \
            --exclude='composer.lock' \
            --exclude='vendor/' \
            --exclude='node_modules/' \
            --exclude='.phpcs.xml.dist' \
            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:~/domains/peptiderepo.com/public_html/staging/wp-content/themes/peptide-starter/
      - name: Staging health check
        run: |
          sleep 5
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://staging.peptiderepo.com/ || echo "000")
          echo "Staging responded: HTTP $STATUS"
      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key

  smoke:
    name: Smoke tests (staging)
    needs: deploy-staging
    continue-on-error: true
    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
    secrets:
      STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
      STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

  deploy-production:
    name: Deploy to Production
    needs: [validate, deploy-staging]  # smoke is informational; not gating prod until e2e suite is stable
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
      - name: Snapshot plugin inventory (pre-deploy)
        # Guards against the 2026-04-23 incident where rsync to wrong path clobbered WP core.
        # Checks that the active plugin count is sane before and after deploy.
        # Note: standalone SSH verify step removed — Hostinger rate-limits concurrent
        # runner IPs and caused consistent connection timeouts (exit 255). The rsync
        # itself will fail safely if the path doesn't exist.
        run: |
          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
            -o StrictHostKeyChecking=accept-new \
            -o ConnectTimeout=30 \
            -o BatchMode=yes \
            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} \
            "wp --path=/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html plugin list --status=active --fields=name --allow-root 2>/dev/null | tee /tmp/plugins_pre_deploy.txt && echo \"Pre-deploy plugin count: \$(wc -l < /tmp/plugins_pre_deploy.txt)\""
      - name: Deploy via rsync → production
        run: |
          rsync -avz --delete \
            --exclude='.git' \
            --exclude='.github' \
            --exclude='tests/' \
            --exclude='phpunit.xml' \
            --exclude='composer.json' \
            --exclude='composer.lock' \
            --exclude='vendor/' \
            --exclude='node_modules/' \
            --exclude='.phpcs.xml.dist' \
            -e "ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes" \
            ./ ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/themes/peptide-starter/
      - name: Verify plugin inventory unchanged (post-deploy)
        run: |
          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
            -o StrictHostKeyChecking=accept-new \
            -o ConnectTimeout=30 \
            -o BatchMode=yes \
            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
            wp --path=/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html plugin list --status=active --fields=name --allow-root 2>/dev/null > /tmp/plugins_post_deploy.txt
            PRE=$(wc -l < /tmp/plugins_pre_deploy.txt)
            POST=$(wc -l < /tmp/plugins_post_deploy.txt)
            echo "Pre-deploy active plugins:  $PRE"
            echo "Post-deploy active plugins: $POST"
            if [ "$POST" -lt "$PRE" ]; then
              echo "ERROR: Plugin count dropped from $PRE to $POST after deploy."
              diff /tmp/plugins_pre_deploy.txt /tmp/plugins_post_deploy.txt || true
              exit 1
            fi
            echo "Plugin inventory OK."
          ENDSSH
      - name: Purge LiteSpeed Cache
        run: |
          ssh -i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} \
            -o StrictHostKeyChecking=accept-new \
            -o ConnectTimeout=30 \
            -o BatchMode=yes \
            ${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }} << 'ENDSSH'
            CACHE_DIR="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/wp-content/litespeed"
            if [ -d "$CACHE_DIR" ]; then
              rm -rf "$CACHE_DIR"/*
              echo "LiteSpeed cache purged."
            fi
            touch "/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html/.lscache_purge" 2>/dev/null || true
          ENDSSH
      - name: Production health check
        run: |
          sleep 5
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
            exit 1
          fi
          echo "Production healthy (HTTP $STATUS)"
      - name: Cleanup
        if: always()
        run: rm -f ~/.ssh/deploy_key
      - name: Deploy summary
        run: |
          echo "## Deployment Complete" >> $GITHUB_STEP_SUMMARY
          echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Deployed to:** peptiderepo.com/themes/peptide-starter" >> $GITHUB_STEP_SUMMARY