name: CI/CD - erp auth

on:
  pull_request:
    branches:
      - production
    types:
      - closed

jobs:
  build-and-deploy:
    name: Build & Deploy
    runs-on: linux
    if: github.event.pull_request.merged == true

    steps:
      - name: Checkout code
        run: |
          git clone \
            --depth 1 \
            --branch production \
            https://oauth2:${{ secrets.ERPAUTH }}@gitea.hexdive.com/New_REP_SYSTEM/Distribution_auth.git \
            .

      - name: Restore
        run: dotnet restore AuthHex.sln

      - name: Publish
        run: |
          dotnet publish AuthHex.csproj \
            -c Release \
            -r linux-x64 \
            --self-contained true \
            -o /tmp/authhex-deploy

      - name: Stop service
        run: systemctl stop erpAuth.service || true

      - name: Deploy
        run: |
          cp -r /tmp/authhex-deploy/* /var/www/internalServices/disAuth/publish/

      - name: Fix ownership and permissions
        run: |
          chown -R hexafitauth:hexafitauth /var/www/internalServices/disAuth/publish/
          find /var/www/internalServices/disAuth/publish/ -type d -exec chmod 755 {} +
          find /var/www/internalServices/disAuth/publish/ -type f -exec chmod 644 {} +
          chmod +x /var/www/internalServices/disAuth/publish/AuthHex

      - name: Start service
        run: systemctl start disAuth.service

      - name: Verify
        run: |
          sleep 3
          systemctl is-active disAuth.service \
            && echo "Service running" \
            || (journalctl -u disAuth.service -n 30 --no-pager && exit 1)