name: Rollback production
on:
  workflow_dispatch:

jobs:
  rollback:
    if: gitea.ref == 'refs/heads/main'
    runs-on: @RUNNER@
    env:
      CI: 'true'
      GITEA_SERVER_URL: ${{ gitea.server_url }}
      CI_REPOSITORY: ${{ gitea.repository }}
      CI_COMMIT: ${{ gitea.sha }}
      CI_REF: ${{ gitea.ref }}
      CI_EVENT: ${{ gitea.event_name }}
      CI_RUN_ID: ${{ gitea.run_id }}
    steps:
      - name: Check out trusted main workflow revision
        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - name: Verify pinned engineering resources
        run: python3 scripts/engineering.py --check
      - name: Identify workflow attempt
        run: java generated/ci/Ci.java attempt
      - name: Restore previous successful release
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
          DEPLOY_USER: ${{ vars.DEPLOY_USER }}
          DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
          DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
          DEPLOY_REGISTRY: ${{ vars.DEPLOY_REGISTRY }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: java generated/ci/Ci.java rollback
      - name: Retain deployment diagnostics for fourteen days
        if: always()
        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
        with:
          name: rollback-${{ gitea.run_id }}-${{ env.CI_RUN_ATTEMPT }}
          path: ci/artifacts/deployment/
          if-no-files-found: warn
          retention-days: 14