# Gitea Actions 工作流：构建 Docker 镜像并通过 SSH 触发部署
# 前置：
#   1. Gitea Runner 已开放 Docker 访问（挂载 /var/run/docker.sock 到容器内）
#   2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文，含 BEGIN/END 行）
#   3. 私钥对应的公钥已加入部署机 ~/.ssh/authorized_keys
name: build-and-deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  DEPLOY_HOST: 114.134.187.170
  DEPLOY_USER: root
  DEPLOY_DIR: /app/registry
  IMAGE_NAME: registry-app
  # SSH 端口：可通过 secrets.SSH_PORT 覆盖，未配置时默认 22
  SSH_PORT: ${{ secrets.SSH_PORT || '22' }}

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: 检出代码
        uses: actions/checkout@v4

      - name: 生成镜像 tag（短 commit）
        id: meta
        run: echo "tag=$(echo ${GITHUB_SHA} | cut -c1-8)" >> "$GITHUB_OUTPUT"

      - name: 构建 Docker 镜像
        run: |
          docker build \
            -t "${IMAGE_NAME}:${{ steps.meta.outputs.tag }}" \
            -t "${IMAGE_NAME}:latest" \
            .

      - name: 准备 SSH 私钥
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          # 关闭 -e，先打印诊断信息，避免任何一步失败导致后续诊断也丢
          set +e
          mkdir -p ~/.ssh

          echo "===== 诊断 1：secret 是否非空 ====="
          # 只打印字节长度，绝对不会泄漏内容
          BYTES=$(printf '%s' "${SSH_PRIVATE_KEY}" | wc -c)
          echo "SSH_PRIVATE_KEY 字节数: ${BYTES}"
          if [ "${BYTES}" -lt 100 ]; then
            echo "❌ secret 内容小于 100 字节，几乎肯定没配置或名字对不上"
            echo "请到 Gitea 仓库 → Settings → Actions → Secrets 确认存在名为 SSH_PRIVATE_KEY 的 secret"
            exit 1
          fi

          echo "===== 诊断 2：写入文件并去 CR ====="
          printf '%s\n' "${SSH_PRIVATE_KEY}" | tr -d '\r' > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          echo "文件字节数: $(wc -c < ~/.ssh/deploy_key)"
          echo "文件行数: $(wc -l < ~/.ssh/deploy_key)"
          echo "首行: $(head -n 1 ~/.ssh/deploy_key)"
          echo "末行: $(tail -n 1 ~/.ssh/deploy_key)"

          echo "===== 诊断 3：ssh-keygen 校验私钥 ====="
          ssh-keygen -y -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub
          KEYGEN_EXIT=$?
          if [ ${KEYGEN_EXIT} -ne 0 ]; then
            echo "❌ ssh-keygen 校验失败（exit=${KEYGEN_EXIT}），私钥格式坏了"
            exit 1
          fi
          echo "公钥指纹:"
          ssh-keygen -l -f ~/.ssh/deploy_key.pub
          echo "公钥内容（把这一行追加到部署机 ~/.ssh/authorized_keys）:"
          cat ~/.ssh/deploy_key.pub

          echo "===== 诊断 4：known_hosts ====="
          ssh-keyscan -p "${SSH_PORT}" -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>&1
          echo "known_hosts 行数: $(wc -l < ~/.ssh/known_hosts)"

      - name: 上传 start.sh 到部署目录
        run: |
          # 强制仅用密钥认证 + 详细日志，password 认证禁用后仍失败会直接抛错
          SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
          ssh -p "${SSH_PORT}" $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
          scp -P "${SSH_PORT}" $SSH_OPTS deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
          ssh -p "${SSH_PORT}" $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"

      - name: 远程执行部署
        run: |
          SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
          ssh -p "${SSH_PORT}" $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "IMAGE_TAG=${{ steps.meta.outputs.tag }} ${DEPLOY_DIR}/start.sh"