name: Deploy to LAN dev server

# Fires on every push to `dev` -- a direct push, or the real merge commit a
# native "auto merge when checks succeed" produces (see pr-build.yml). Mirrors
# the monorepo's .forgejo/workflows/deploy-dev.yml, split to roll only the
# frontend service.
#
# INERT until the LAN dev box is reprovisioned: deploy-dev.sh does not live in
# this repo's checkout -- it lives in the INFRA checkout at
# $HOME/thermograph-dev on that box (and self-updates there via its own `git
# reset` against thermograph-infra), the same way the monorepo's deploy-dev.sh
# is invoked. That box is currently provisioned as a thermograph (monorepo)
# checkout, not a thermograph-infra one, so until it's reprovisioned this
# job's deploy step has nothing to run against and will fail at the shell
# call below -- expected, not a bug in this workflow.

on:
  push:
    branches: [dev]
  workflow_dispatch: {}

jobs:
  build:
    name: build
    # Fixed (unparameterized) group, same convention as the deploy job's
    # below: if two pushes to dev land close together, the newer push's
    # build cancels the older's still-running one rather than letting both
    # run to completion on the single physical runner -- the older push's
    # result would just be thrown away once needs:build gates its deploy
    # against a stale build anyway. Safe to cancel mid-run: build.yml only
    # proves the Dockerfile builds, nothing persisted.
    concurrency:
      group: dev-push-build
      cancel-in-progress: true
    uses: ./.forgejo/workflows/build.yml

  deploy:
    needs: build
    # NOT [self-hosted, thermograph-lan] -- GitHub implicitly tags every
    # self-hosted runner with "self-hosted" automatically; Forgejo's runner
    # has only the labels it was explicitly registered with ("docker" +
    # "thermograph-lan", no "self-hosted"). The array form would silently
    # make this job unschedulable on every push, same gotcha the monorepo's
    # deploy-dev.yml documents and fixes the same way.
    runs-on: thermograph-lan
    # Only needs to read the repo to compute the SHA tag.
    permissions:
      contents: read
    concurrency:
      group: dev-lan-deploy
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4

      - name: Compute image tag
        id: tag
        run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"

      - name: Deploy to the LAN dev server
        run: |
          SERVICE=frontend FRONTEND_IMAGE_TAG=${{ steps.tag.outputs.tag }} \
            bash "$HOME/thermograph-dev/deploy/deploy-dev.sh"