# Gitea Actions workflow for vor.
#
# THIS FILE LIVES IN THE VOR REPO, NOT HERE.
# Copy to vh/vor:.gitea/workflows/deploy.yaml and commit.
#
# Identical pattern to stacks/task-board/gitea-workflow-deploy.yaml.example
# — checks out vor + eshpfi-management, then runs the elway playbook
# pinned to the triggering commit SHA. The playbook is the single
# source of truth for "how vor is deployed", manual or automated.
#
# Required Actions secrets (already set at user scope from earlier
# task-board wiring; nothing new needed):
#
#   DEPLOY_SSH_KEY    Private SSH key authorized for lkraven@ana-docker.
#   MGMT_REPO_TOKEN   Gitea PAT (read:repository) on vh/esh-pfi-infrastructure.

name: Deploy vor

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: pfi-fleet

    steps:
      - name: Install playbook prerequisites
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends \
            python3 python3-yaml openssh-client
          rm -rf /var/lib/apt/lists/*

      - name: Checkout vor (triggering repo)
        uses: actions/checkout@v4

      - name: Checkout management repo (eshpfi-management)
        uses: actions/checkout@v4
        with:
          repository: vh/esh-pfi-infrastructure
          token: ${{ secrets.MGMT_REPO_TOKEN }}
          path: _mgmt

      - name: Configure SSH to ana-docker
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          cat > ~/.ssh/config <<'EOF'
          Host ana-docker
            HostName 10.250.50.70
            User lkraven
            IdentityFile ~/.ssh/id_ed25519
            StrictHostKeyChecking accept-new
          EOF
          chmod 600 ~/.ssh/config

      - name: Deploy vor (elway playbook, pinned to this commit)
        working-directory: _mgmt
        run: |
          scripts/elway ana-docker \
            --playbook playbooks/deploy-vor.yaml \
            --var ref=${{ github.sha }}