name: Deploy Pages

on:
  workflow_dispatch:
    inputs:
      commit_sha:
        description: Full 40-character commit SHA to deploy
        required: true
        type: string

concurrency:
  group: pages-production
  cancel-in-progress: false

permissions:
  contents: read
  deployments: write

jobs:
  deploy-pages:
    name: Deploy exact commit to Pages
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://sheepdogsim.com
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.commit_sha }}
          fetch-depth: 0

      - name: Verify exact source commit
        id: source
        env:
          REQUESTED_SHA: ${{ inputs.commit_sha }}
        run: |
          set -euo pipefail
          if [[ ! "$REQUESTED_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
            echo "commit_sha must be a full 40-character Git SHA." >&2
            exit 1
          fi
          actual_sha="$(git rev-parse HEAD)"
          if [[ "${actual_sha,,}" != "${REQUESTED_SHA,,}" ]]; then
            echo "Checked out $actual_sha, expected $REQUESTED_SHA." >&2
            exit 1
          fi
          if ! git merge-base --is-ancestor "$actual_sha" origin/main; then
            echo "$actual_sha is not contained in origin/main." >&2
            exit 1
          fi
          echo "sha=$actual_sha" >> "$GITHUB_OUTPUT"

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm

      - run: npm ci
      - run: npm ci --prefix worker
      - run: npm run lint --if-present
      - run: npm run typecheck --if-present
      - run: npm run typecheck:worker
      - name: Acquire approved game audio
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y ffmpeg
          node tools/prepare-approved-audio.mjs --download
      - run: npm run build
        env:
          SDS_RELEASE_SHA: ${{ steps.source.outputs.sha }}
          SDS_RELEASE_REF: ${{ inputs.commit_sha }}
      - run: npm run check:discovery
      - run: npm test --if-present

      - name: Write and verify release identity
        env:
          SDS_RELEASE_SHA: ${{ steps.source.outputs.sha }}
          SDS_RELEASE_REF: ${{ inputs.commit_sha }}
        run: |
          node scripts/write-release-manifest.mjs
          node scripts/verify-release-manifest.mjs --path dist/release.json --sha "$SDS_RELEASE_SHA" --require-v3-static

      - name: Archive exact Pages artifact
        uses: actions/upload-artifact@v5
        with:
          name: pages-${{ steps.source.outputs.sha }}
          path: dist/
          if-no-files-found: error
          retention-days: 90

      - name: Deploy Pages artifact
        uses: cloudflare/wrangler-action@v4
        with:
          apiToken: ${{ secrets.CF_API_TOKEN }}
          accountId: ${{ secrets.CF_ACCOUNT_ID }}
          command: pages deploy dist --project-name=sds-frontend --branch=main --commit-hash=${{ steps.source.outputs.sha }}

      - name: Verify live release identity
        run: node scripts/verify-release-manifest.mjs --url https://sheepdogsim.com/release.json --sha "${{ steps.source.outputs.sha }}" --retries 12

      - name: Verify live discovery and analytics
        run: node scripts/verify-public-discovery.mjs --url https://sheepdogsim.com --require-analytics --retries 12