name: Sync infra to hosts

# The infra DOMAIN's own pipeline (new with the monorepo -- the split era had
# no infra deploy workflow at all; infra changes rode along lazily with the
# next app deploy's `git reset`). On a push to `main` touching infra/**, SSH
# to beta AND prod, fast-forward the host's /opt/thermograph monorepo checkout
# and re-render /etc/thermograph.env from the SOPS vault -- so a compose edit
# or a secret rotation lands push-button instead of waiting for the next app
# deploy.
#
# Deliberately does NOT roll any service: image tags are the app domains'
# axis, not infra's. A compose change that must recreate containers takes
# effect on the next app deploy, or a by-hand
# `SERVICE=all ... infra/deploy/deploy.sh` run (see that script's header).
#
# Both hosts track infra via `main` (the split-era model, unchanged): prod's
# *app images* are staged by the `release` branch, but its checkout follows
# main -- deploy.sh's own BRANCH default encodes the same thing.

on:
  push:
    branches: [main]
    paths: ['infra/**']
  workflow_dispatch: {}

jobs:
  sync-beta:
    runs-on: docker
    concurrency:
      group: infra-sync-beta
      cancel-in-progress: false
    steps:
      - name: Sync beta checkout + re-render secrets
        uses: https://github.com/appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.SSH_PORT }}
          script: |
            set -euo pipefail
            cd /opt/thermograph
            git fetch --prune origin main
            git reset --hard origin/main
            if [ -f infra/deploy/render-secrets.sh ]; then
              . infra/deploy/render-secrets.sh
              render_thermograph_secrets /opt/thermograph/infra
            fi
            echo "synced to $(git log --oneline -1)"

  sync-prod:
    runs-on: docker
    concurrency:
      group: infra-sync-prod
      cancel-in-progress: false
    steps:
      - name: Sync prod checkout + re-render secrets
        uses: https://github.com/appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.PROD_SSH_HOST }}
          username: ${{ secrets.PROD_SSH_USER }}
          key: ${{ secrets.PROD_SSH_KEY }}
          port: ${{ secrets.PROD_SSH_PORT }}
          script: |
            set -euo pipefail
            cd /opt/thermograph
            git fetch --prune origin main
            git reset --hard origin/main
            if [ -f infra/deploy/render-secrets.sh ]; then
              . infra/deploy/render-secrets.sh
              render_thermograph_secrets /opt/thermograph/infra
            fi
            echo "synced to $(git log --oneline -1)"