# Deploy — files over rsync. Runs on every push to main and on manual
# dispatch, because scripts are not versioned — they go live immediately.
# Requires secrets: DEPLOY_HOST, DEPLOY_USER, DEPLOY_PATH, DEPLOY_PASSWORD.
name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: alpine
    steps:
      - uses: actions/checkout@v7

      - name: Generate SHA256SUMS
        run: sha256sum *.py > SHA256SUMS

      - name: Deploy via rsync
        timeout-minutes: 3
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
        run: |
          set -euo pipefail
          echo "Deploying to ${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"

          sshpass -p "$DEPLOY_PASSWORD" rsync -avz --delete \
            -e "ssh -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null" \
            *.py SHA256SUMS "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"

          echo "Deploy complete."