name: Deploy OCI Site
description: Build a Nix flake OCI image, push to registry, and deploy via Nomad

inputs:
  domain:
    description: 'Domain the site is served at (e.g. toph.so)'
    required: true

  registry:
    description: 'Container registry host'
    required: false
    default: 'registry.toph.so'

  s3-endpoint:
    description: 'S3 endpoint for the Nix binary cache'
    required: false
    default: 'https://s3.toph.so'

  nomad-addr:
    description: 'Nomad API address'
    required: false
    default: 'http://172.17.0.1:4646'

  smoke-test:
    description: 'Run a smoke test against the domain after deploy'
    required: false
    default: 'true'

runs:
  using: composite
  steps:
    - name: Install tools
      shell: bash
      run: nix profile install nixpkgs#skopeo nixpkgs#nomad

    - name: Build OCI image
      shell: bash
      run: nix build .#ociImage --out-link result-image

    - name: Push image to registry
      shell: bash
      run: |
        IMAGE_TAG=$(nix eval --raw .#packages.x86_64-linux.ociImage.imageTag)
        skopeo copy \
          docker-archive:./result-image \
          docker://${{ inputs.registry }}/${{ inputs.domain }}:${IMAGE_TAG}
        skopeo copy \
          docker-archive:./result-image \
          docker://${{ inputs.registry }}/${{ inputs.domain }}:latest
        echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV

    - name: Sign and push Nix closure to cache
      shell: bash
      run: |
        echo "${NIX_SIGNING_KEY}" > /tmp/nix-key
        nix store sign -k /tmp/nix-key --recursive ./result-image
        nix copy \
          --to "s3://nix-cache?endpoint=${{ inputs.s3-endpoint }}&access-key-id=${S3_ACCESS_KEY}&secret-access-key=${S3_SECRET_KEY}" \
          ./result-image
        rm /tmp/nix-key
      env:
        NIX_SIGNING_KEY: ${{ env.NIX_SIGNING_KEY }}
        S3_ACCESS_KEY: ${{ env.S3_ACCESS_KEY }}
        S3_SECRET_KEY: ${{ env.S3_SECRET_KEY }}

    - name: Register Nomad job
      shell: bash
      run: |
        nomad job run "${{ github.action_path }}/static-site.hcl"
      env:
        NOMAD_ADDR: ${{ inputs.nomad-addr }}

    - name: Dispatch deployment
      shell: bash
      run: |
        nomad job dispatch \
          -meta "image_tag=${IMAGE_TAG}" \
          -meta "domain=${{ inputs.domain }}" \
          static-site
      env:
        NOMAD_ADDR: ${{ inputs.nomad-addr }}

    - name: Smoke test
      if: inputs.smoke-test == 'true'
      shell: bash
      run: |
        echo "Waiting for deployment..."
        for i in $(seq 1 12); do
          if curl -sf --max-time 5 "https://${{ inputs.domain }}/" > /dev/null; then
            echo "OK — https://${{ inputs.domain }}/ is up"
            exit 0
          fi
          echo "Attempt ${i}/12 — retrying in 5s..."
          sleep 5
        done
        echo "Smoke test failed: https://${{ inputs.domain }}/ did not respond"
        exit 1