name: Deploy production
on:
  workflow_dispatch:
    inputs:
      mode:
        description: 'Release mode'
        required: true
        type: choice
        default: new
        options:
          - new
          - retry
      increment:
        description: 'New release only: semantic version increment (first release is v1.0.0)'
        required: true
        type: choice
        default: patch
        options:
          - patch
          - minor
          - major
      version:
        description: 'Retry only: existing version tag, e.g. v1.2.3; leave empty for new release'
        required: false
        type: string

# Gitea 1.25 ignores concurrency. The helper acquires a NAS-wide mkdir lock.
jobs:
  deploy:
    if: gitea.ref == 'refs/heads/main'
    runs-on: @RUNNER@
    env:
      CI: 'true'
      GITEA_SERVER_URL: ${{ gitea.server_url }}
      CI_REPOSITORY: ${{ gitea.repository }}
      CI_COMMIT: ${{ gitea.sha }}
      CI_REF: ${{ gitea.ref }}
      CI_EVENT: ${{ gitea.event_name }}
      CI_RUN_ID: ${{ gitea.run_id }}
    steps:
      - name: Check out trusted main workflow revision
        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - name: Verify pinned engineering resources
        run: python3 scripts/engineering.py --check
      - name: Identify workflow attempt
        run: java generated/ci/Ci.java attempt
      - name: Release verified images
        env:
          RELEASE_MODE: ${{ inputs.mode }}
          RELEASE_INCREMENT: ${{ inputs.increment }}
          RELEASE_VERSION: ${{ inputs.version }}
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
          DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
          DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
          DEPLOY_REGISTRY: ${{ vars.DEPLOY_REGISTRY }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: java generated/ci/Ci.java deploy
      - name: Retain deployment diagnostics for fourteen days
        if: always()
        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
        with:
          name: deployment-${{ gitea.run_id }}-${{ env.CI_RUN_ATTEMPT }}
          path: ci/artifacts/deployment/
          if-no-files-found: warn
          retention-days: 14