name: Deploy Server

on:
  push:
    tags:
      - 'server-v[0-9]*.[0-9]*.[0-9]*'
  workflow_dispatch:

concurrency:
  group: deploy-server
  cancel-in-progress: false

jobs:
  deploy-server:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # runner 镜像(catthehacker ubuntu:act-latest,label ubuntu-latest)自带 node
      # 但**不带 go** → 直接 `go build` 会 `go: command not found`(exit 127)。
      # 故先装 go:从 Go 官方**中国镜像** golang.google.cn 取(go.dev 在墙内不稳),
      # 版本对齐 server/go.mod 的 1.25.10;装到 /usr/local/go 并加进 $GITHUB_PATH
      # 供后续 Compile/Test 步骤共用。模块下载仍走 GOPROXY=goproxy.cn(见 _env.sh)。
      - name: Setup Go 1.25.10(CN 镜像)
        run: |
          GO_VER=1.25.10
          # 供应链完整性:校验 sha256(取自 Go 官方 release JSON,pin 为字面量),
          # 防镜像被篡改/MITM 注入恶意工具链(它会编译要上生产的二进制)。校验失败即中止。
          GO_SHA256=42d4f7a32316aa66591eca7e89867256057a4264451aca10570a715b3637ba70
          curl -fsSL --max-time 180 --retry 3 --retry-delay 5 --retry-connrefused \
            "https://golang.google.cn/dl/go${GO_VER}.linux-amd64.tar.gz" -o /tmp/go.tgz
          echo "${GO_SHA256}  /tmp/go.tgz" | sha256sum -c -
          rm -rf /usr/local/go
          tar -C /usr/local -xzf /tmp/go.tgz
          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
          export PATH=/usr/local/go/bin:$PATH
          go version

      # 直接在 runner 跑(不嵌套 docker,避免 DinD 挂载失败;go 由上一步装好)。
      - name: Compile (Go 控制面)
        run: bash scripts/ci/compile-backend.sh

      - name: Test (go test)
        run: bash scripts/ci/test.sh server

      - name: Release → Forgejo
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
          TAG: ${{ gitea.ref_name }}
        run: bash scripts/ci/release-server.sh "$TAG"

      - name: Deploy → pangolin1
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          TAG: ${{ gitea.ref_name }}
        run: bash scripts/ci/deploy-server.sh "$TAG"