name: mindflux-ci

on:
  push:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Docker build
        run: docker build -t mindflux:latest .

      - name: Docker push
        run: |
          docker tag mindflux:latest localhost:5000/mindflux:latest
          docker push localhost:5000/mindflux:latest

      - name: Deploy
        env:
          MINDFLUX_DB_PASSWORD: ${{ secrets.MINDFLUX_DB_PASSWORD }}
          MINDFLUX_ADMIN_PASSWORD: ${{ secrets.MINDFLUX_ADMIN_PASSWORD }}
          MINDFLUX_ADMIN2_PASSWORD: ${{ secrets.MINDFLUX_ADMIN2_PASSWORD }}
          MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
        run: |
          test -n "$MINDFLUX_DB_PASSWORD" || { echo "MINDFLUX_DB_PASSWORD fehlt" >&2; exit 1; }
          docker exec -i -e NEW_DB_PASSWORD="$MINDFLUX_DB_PASSWORD" postgres \
            psql -v ON_ERROR_STOP=1 -U mindflux -d mindfluxdb <<'SQL'
          \getenv new_db_password NEW_DB_PASSWORD
          ALTER USER mindflux WITH PASSWORD :'new_db_password';
          SQL
          docker compose -f docker-compose.yml pull
          docker compose -f docker-compose.yml up -d --wait --wait-timeout 90 || {
            docker logs --tail 200 mindflux >&2
            exit 1
          }
          # Einmalige, tokenfreie Diagnose für die eben ausgelöste Registrierung.
          docker exec postgres psql -At -U mindflux -d mindfluxdb \
            -c "SELECT username, email_verified FROM users WHERE lower(email) = lower('alicedarkest@gmx.de');"
          docker exec postgres psql -At -U mindflux -d mindfluxdb \
            -c "SELECT t.purpose, t.expires_at > CURRENT_TIMESTAMP, t.consumed_at IS NULL FROM account_email_tokens t JOIN users u ON u.id = t.user_id WHERE lower(u.email) = lower('alicedarkest@gmx.de');"