name: CI

# Tests and prek on every push and pull request. A push to main that passes both deploys
# to sega, while the repository variable DEPLOY_SEGA is true.
on:
  push:
  pull_request:

jobs:
  tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # bind9-utils provides named-checkzone, used by the zone sync tests.
      - name: Install system dependencies
        run: |
          SUDO=$(command -v sudo || true)
          $SUDO apt-get update
          $SUDO apt-get install -y --no-install-recommends bind9-utils

      - name: Install mise
        run: |
          curl -fsSL https://mise.run | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Install pinned tools
        run: mise install

      - name: Install Python dependencies
        run: mise exec -- uv sync --locked --no-group prod

      - name: Unit tests
        run: mise exec -- uv run --no-sync pytest

  # The hooks in prek.toml.
  prek:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: j178/prek-action@v1

  # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh
  # command line, builds that commit on the host and switches to it (edb-infra's
  # roles/mdb.md).
  deploy-sega:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_SEGA == 'true'
    runs-on: ubuntu-latest
    needs:
      - tests
      - prek
    steps:
      - name: Deploy
        run: |
          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
          eval $(ssh-agent -s)
          echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
          ssh mdb-deploy@sega.neuf.no "${{ github.sha }}"