name: Seeds CI/CD

on:
  push:
    branches:
      - "main"
    paths:
      - "db/seeds/**"
      - "typescript/seeds-scripts/**"
      - "typescript/common/**"
      - ".github/workflows/database-seeds.yml"
  pull_request:
    branches:
      - "main"
    paths:
      - "db/seeds/**"
      - "typescript/seeds-scripts/**"
      - "typescript/common/**"
      - ".github/workflows/database-seeds.yml"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/zkldi/tachi-dev:main
      options: --user root
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run Tests
        run: bun run --filter tachi-seeds-scripts test
        env:
          NODE_ENV: "test"

  deploy:
    runs-on: ubuntu-latest
    needs: [test]
    if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
    concurrency:
      group: "seeds-lock-${{ github.sha }}"
      cancel-in-progress: false
    steps:
      - name: Enable SSH
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
        run: |
          mkdir -p ~/.ssh
          printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts

      - name: Deploy seeds
        env:
          TACHI_HOST: ${{ secrets.TACHI_HOST }}
        run: ssh -i ~/.ssh/id_rsa "ci@${TACHI_HOST}" /home/ci/tachi-deploy/swarm/deploy-seeds.sh "${{ github.sha }}"