name: website

# 官网 CI/CD：push web/website/** → 构建（红线词扫描 + lint + CSP 哈希）→ 同时发布主站与镜像。
# 与仓库根 .gitea/workflows/ci.yml 解耦：官网完全静态、与后端无依赖，可独立并行。
#
# 需在 Gitea 配置 Secrets：
#   CF_API_TOKEN            Cloudflare API Token（Pages:Edit 权限）
#   CF_ACCOUNT_ID           Cloudflare Account ID
#   CF_PAGES_PROJECT_MAIN   主站 Pages 项目名
#   CF_PAGES_PROJECT_MIRROR 镜像 Pages 项目名（≥1 个活跃镜像，应对主域名被墙）
# 并把 runs-on 改成实际 runner label。

on:
  push:
    paths:
      - 'web/website/**'
      - '.gitea/workflows/website.yml'
  pull_request:
    paths:
      - 'web/website/**'
  workflow_dispatch:

env:
  # 主站 canonical 域名；镜像也用同一值 → canonical 指向主站 + 产物 hash 一致。
  SITE_URL: https://pangolin.example

jobs:
  # ── 构建 + 校验（红线 / lint / CSP / 指纹） ──────────────────────────────
  build:
    name: Build & Verify
    runs-on: nas
    defaults:
      run:
        working-directory: web/website
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install (clean, reproducible)
        run: npm ci

      - name: Type-check (lint)
        run: npm run lint

      - name: Build (含 token 同源 + CSP 哈希注入)
        run: npm run build

      - name: Redline scan (脱敏铁律 13)
        run: npm run scan:redline

      - name: CSP sanity (禁止 unsafe-inline)
        run: grep -L "unsafe-inline" dist/_headers

      - name: Fingerprint (主站/镜像一致性基线)
        run: npm run hash:dist | tee dist.fingerprint

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: website-dist
          path: web/website/dist

  # ── 同时发布主站与镜像（同一份 dist，hash 必然一致） ─────────────────────
  deploy:
    name: Deploy main + mirror
    needs: build
    if: github.event_name == 'push'
    runs-on: nas
    defaults:
      run:
        working-directory: web/website
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install
        run: npm ci

      - name: Build
        run: npm run build

      - name: Deploy → 主站 (Cloudflare Pages)
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
        run: npx wrangler pages deploy dist --project-name "${{ secrets.CF_PAGES_PROJECT_MAIN }}" --branch main

      - name: Deploy → 镜像 (Cloudflare Pages)
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
        run: npx wrangler pages deploy dist --project-name "${{ secrets.CF_PAGES_PROJECT_MIRROR }}" --branch main

      - name: Verify main == mirror (内容一致性)
        run: |
          echo "主站与镜像部署的是同一份 dist，指纹："
          npm run --silent hash:dist