name: Deploy hotfix to production

on:
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch to deploy directly to production (e.g. hotfix/mollie-fix)'
        required: true
        default: 'main'

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

    steps:
      - name: Checkout branch
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Clean UTF-8 BOM
        run: |
          sed -i '1s/^\xEF\xBB\xBF//' lang/*.json

      - name: Validate translation JSON files
        run: |
          for file in lang/*.json; do
            echo "Checking $file"
            python -m json.tool "$file" > /dev/null || exit 1
          done

      - name: Build assets
        run: npm run build

      - name: Remove node_modules before upload
        run: rm -rf node_modules

      # Site blijft UP tijdens upload en composer install
      - name: Deploy files via lftp
        env:
          SFTP_HOST: ${{ secrets.SFTP_HOST }}
          SFTP_USER: ${{ secrets.SFTP_USERNAME }}
          SFTP_PASS: ${{ secrets.SFTP_PASSWORD }}
          SFTP_PORT: ${{ secrets.SFTP_PORT }}
        run: |
          sudo apt-get install -y lftp
          lftp -c "
            set sftp:connect-program 'ssh -o StrictHostKeyChecking=no -p $SFTP_PORT';
            set net:timeout 30;
            set net:max-retries 3;
            set net:reconnect-interval-base 5;
            open sftp://$SFTP_USER:$SFTP_PASS@$SFTP_HOST;
            mirror --reverse \
              --exclude=^storage/ \
              --exclude=^vendor/ \
              --exclude=^\.env\$ \
              --exclude=^phpunit\.xml\$ \
              --exclude=^README\.md\$ \
              --exclude=^USER_GUIDE\.md\$ \
              --exclude=^CLAUDE\.md\$ \
              . ./www/
          "

      # Composer install (indien nodig) — site nog steeds UP
      # Daarna: artisan down (~30 sec) → migrate + cache → artisan up
      - name: Composer install + artisan deploy (minimale downtime)
        env:
          SFTP_USER: ${{ secrets.SFTP_USERNAME }}
          SFTP_PASS: ${{ secrets.SFTP_PASSWORD }}
        run: |
          sudo apt-get install -y sshpass
          LOCK_HASH=$(md5sum composer.lock | cut -d' ' -f1)
          sshpass -p "$SFTP_PASS" ssh -o StrictHostKeyChecking=no \
            $SFTP_USER@ssh.cluster100.hosting.ovh.net "bash -s" <<ENDSSH
          set -e
          cd www
          mkdir -p bootstrap/cache storage/framework/sessions storage/framework/views storage/framework/cache storage/logs
          chmod -R 775 bootstrap/cache storage
          [ -L public/storage ] || (rm -rf public/storage && ln -s ../storage/app/public public/storage)

          STORED=\$(cat /tmp/ndlink_composer_lock_hash 2>/dev/null || echo "")
          if [ "${LOCK_HASH}" != "\$STORED" ]; then
            echo "composer.lock gewijzigd — composer install uitvoeren..."
            php -r "copy('https://getcomposer.org/installer', '/tmp/composer-setup.php');"
            php /tmp/composer-setup.php --quiet --install-dir=/tmp --filename=composer
            php /tmp/composer install --no-dev --optimize-autoloader --no-interaction
            echo "${LOCK_HASH}" > /tmp/ndlink_composer_lock_hash
          else
            echo "composer.lock ongewijzigd — stap overgeslagen"
          fi

          trap 'php artisan up && echo "Site is terug online"' EXIT
          php artisan down --retry=30
          php artisan optimize:clear
          php artisan migrate --force
          php artisan db:seed --class=InterestTagSeeder --force
          php artisan interests:migrate-csv
          php artisan config:cache
          php artisan route:cache
          php artisan view:cache
          ENDSSH
