# .github/workflows/deploy.yml — auto-deploy to Uncloud on push to main.
#
# The (amd64) runner builds the image, pushes it straight to your machine via
# Unregistry, and rolls the service with a zero-downtime deploy. No external
# registry required.
#
# Repo secret (Settings -> Secrets and variables -> Actions):
#   DROPLET_SSH_KEY  - private SSH key whose public half is in the server's
#                      root (or uncloud-user) authorized_keys. Use a dedicated
#                      deploy key, not your personal one.
#
# Replace <server-ip>, and make sure UC_VERSION matches the uncloudd daemon
# version on the machine (uc + daemon must be in lockstep).

name: Deploy to Uncloud

on:
  push:
    branches: [main]
  workflow_dispatch: {}

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

env:
  UC_VERSION: v0.20.0
  MACHINE_HOST: <server-ip>

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Install uc CLI (matched to the daemon)
        run: |
          curl -fsSL -o uc.tar.gz \
            "https://github.com/psviderski/uncloud/releases/download/${UC_VERSION}/uc_linux_amd64.tar.gz"
          tar -xzf uc.tar.gz uc
          sudo install uc /usr/local/bin/uc
          rm -f uc uc.tar.gz

      - name: Configure SSH deploy key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.DROPLET_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${MACHINE_HOST}" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Build, push, and deploy
        env:
          UNCLOUD_CONNECT: ssh://root@${{ env.MACHINE_HOST }}
        run: |
          uc build --push
          # --recreate: :latest is a mutable tag, so uc won't roll on the tag
          # string alone. Force the container to be recreated from the freshly
          # pushed image so new code actually goes live.
          uc deploy --no-build --recreate -y
