name: Deploy to Dev

on:
  workflow_call:
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Ansible and collections
        run: |
          pip install --break-system-packages ansible
          ansible-galaxy collection install ansible.posix community.docker

      - name: Set up SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SRV_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key

      - name: Run Ansible playbook
        run: |
          ansible-playbook \
            -i infra/development/hosts.ini \
            -e "ansible_ssh_private_key_file=~/.ssh/deploy_key" \
            -e "anthropic_api_key=${{ secrets.ANTHROPIC_API_KEY }}" \
            -e "entra_tenant_id=${{ secrets.ENTRA_TENANT_ID }}" \
            -e "entra_client_id=${{ secrets.ENTRA_CLIENT_ID }}" \
            -e "entra_client_secret=${{ secrets.ENTRA_CLIENT_SECRET }}" \
            -e "entra_admin_emails=${{ secrets.ENTRA_ADMIN_EMAILS }}" \
            infra/development/site/deploy-playbook.yml

      # TEMP DIAGNOSTIC — investigating a 502 from pocketbase-learning on this
      # environment. Remove this step once resolved.
      - name: TEMP DIAGNOSTIC - pocketbase-learning status and logs
        if: always()
        run: |
          ssh -o StrictHostKeyChecking=no -i ~/.ssh/deploy_key -p 4484 root@46.224.220.37 "
            cd /opt/learning-platform &&
            echo '--- docker compose ps ---' &&
            docker compose ps &&
            echo '--- pocketbase-learning logs (last 200 lines) ---' &&
            docker compose logs --tail=200 pocketbase-learning &&
            echo '--- learning-platform (caddy) logs (last 50 lines) ---' &&
            docker compose logs --tail=50 learning-platform
          "