name: site

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check file references and external requests
        run: python3 tools/check_site.py

  build:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Check tooling
        run: docker version --format '{{.Server.Version}}' && docker compose version
      - name: Build image
        run: docker build -t rezayaghobi-site:${GITHUB_SHA::7} .
      - name: Validate nginx config
        run: docker run --rm rezayaghobi-site:${GITHUB_SHA::7} nginx -t
      - name: Check site files are in the image
        run: |
          docker run --rm --entrypoint sh rezayaghobi-site:${GITHUB_SHA::7} \
            -c 'test -f /usr/share/nginx/html/index.html && test -d /usr/share/nginx/html/assets'

  deploy:
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        run: |
          export TAG=${GITHUB_SHA::7}
          docker compose -p portfolio -f deploy/compose.yaml up -d --wait
      - name: Smoke test
        run: |
          curl -fsS http://portfolio:8080/ | grep -qi yaghobi
          curl -fsSI http://portfolio:8080/ | grep -qi content-security-policy
          test "$(curl -s -o /dev/null -w '%{http_code}' http://portfolio:8080/README.md)" = 404