---
# yamllint disable rule:line-length
name: deploy neuro

on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
    inputs:
      upload_cache:
        description: Upload build outputs to Attic
        required: false
        type: boolean
        default: true
      runner_label:
        description: Runner label for deploy job
        required: false
        type: choice
        default: nix
        options:
          - nix
          - gross-nix-x86-perf
          - gross-nix-x86-highmem

concurrency:
  group: deploy-neuro
  cancel-in-progress: false

jobs:
  deploy:
    name: deploy neuro from performance node
    if: ${{ gitea.ref == 'refs/heads/master' }}
    runs-on: ${{ gitea.event.inputs.runner_label || 'nix' }}
    timeout-minutes: 435
    env:
      NIX_CONFIG: |
        fallback = true
        http2 = false
        extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
        trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
    steps:
      - name: Checkout dispatched revision
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
        with:
          ref: ${{ gitea.sha }}
          persist-credentials: false

      - name: Show runner and cache configuration
        run: |
          set -eu
          uname -a
          nix --version
          nix config show http2
          nix config show fallback
          nix config show substituters
          nix config show trusted-public-keys

      - name: Deploy neuro
        env:
          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
          UPLOAD_CACHE: ${{ inputs.upload_cache }}
          WITH_ATTIC_BUILD_TIMEOUT: "21600"
          WITH_ATTIC_DRAIN_TIMEOUT: "3600"
          WITH_ATTIC_UPLOAD_TIMEOUT: "600"
          WITH_ATTIC_BATCH_SIZE: "4"
          NEURO_SSH_PRIVATE_KEY: ${{ secrets.NEURO_SSH_PRIVATE_KEY }}
          NEURO_SSH_KNOWN_HOSTS: ${{ secrets.NEURO_SSH_KNOWN_HOSTS }}
        run: |
          set -eu
          test -n "$NEURO_SSH_PRIVATE_KEY"
          test -n "$NEURO_SSH_KNOWN_HOSTS"
          ssh_home=$(mktemp -d)
          trap 'rm -rf "$ssh_home"' EXIT
          install -d -m 700 "$ssh_home/.ssh"
          printf '%s\n' "$NEURO_SSH_PRIVATE_KEY" > "$ssh_home/.ssh/id_ed25519"
          printf '%s\n' "$NEURO_SSH_KNOWN_HOSTS" > "$ssh_home/.ssh/known_hosts"
          chmod 600 "$ssh_home/.ssh/id_ed25519" "$ssh_home/.ssh/known_hosts"
          printf '%s\n' \
            'Host neuro' \
            '  HostName 95.31.254.84' \
            '  User root' \
            '  Port 34457' \
            "  IdentityFile $ssh_home/.ssh/id_ed25519" \
            '  IdentitiesOnly yes' \
            '  StrictHostKeyChecking yes' \
            "  UserKnownHostsFile $ssh_home/.ssh/known_hosts" \
            > "$ssh_home/.ssh/config"
          chmod 600 "$ssh_home/.ssh/config"
          export HOME="$ssh_home"
          export HECTIC_DEPLOY_SSH_CONFIG="$HOME/.ssh/config"
          export NIX_SSHOPTS="-F $HOME/.ssh/config -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519"
          ssh -F "$HOME/.ssh/config" -o BatchMode=yes -o ConnectTimeout=10 \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile="$HOME/.ssh/known_hosts" \
            -o IdentitiesOnly=yes \
            -i "$HOME/.ssh/id_ed25519" \
            neuro true
          # Run deploy tool from checked-out Gitea revision; repository is not mirrored on GitHub.
          case "$UPLOAD_CACHE" in
            true)
              nix run --refresh '.#with-attic-cache' -- -- \
                nix run --refresh '.#deploy' -- \
                  push -- --flake '.#neuro|x86_64-linux' --target-host neuro
              ;;
            false)
              unset ATTIC_TOKEN
              timeout --kill-after=60s 21600s \
                nix run --refresh '.#deploy' -- \
                  push -- --flake '.#neuro|x86_64-linux' --target-host neuro
              ;;
            *)
              printf 'unsupported upload_cache value: %s\n' "$UPLOAD_CACHE" >&2
              exit 64
              ;;
          esac