name: deploy-production

# 并发治理（Gitea 1.26+ 支持）：同一 ref 同时只允许一个 deploy，新的等老的跑完。
# 生产环境 cancel-in-progress=false（区别于 test/uat）：deploy 中途被 kill 可能留
# inconsistent state（PM2 reload 一半 / docker compose 改了一半），让老的安全跑完更稳。
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

# 同时部署 FFAI Workspace + AIxC Workspace 到各自的生产服务器（并发，~6min vs 之前串行 ~12min）。
# 单 job 内后台执行两个 SSH，任一失败整个 job 失败；两个互不阻塞。
# 注意：生产环境只读铁律 — 此处只是 CI 触发标准化部署脚本（deploy.sh production deploy），
# 不直接 SSH 改文件。脚本本身遵守生产部署链路（git pull → build → pm2 reload）。

permissions:
  contents: read

on:
  push:
    branches:
      - production

jobs:
  pre-deploy-checks:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # L4 部署前：env 校验 / 连通性 / 备份就位
    # 任何一项失败都阻断部署
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup deploy SSH
        uses: ./.gitea/actions/setup-deploy-ssh
        with:
          ssh_key: ${{ secrets.DEPLOY_SSH_KEY }}
          hosts: '43.130.6.44'

      - name: Env vars required check
        run: |
          DEPLOY_HOST="43.130.6.44"
          ssh $DEPLOY_SSH_OPTS srvadmin@"$DEPLOY_HOST" \
            'cd /srv/apps/ffworkspace && bash scripts/ops/env-check.sh production'

  deploy:
    needs: pre-deploy-checks
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup deploy SSH
        uses: ./.gitea/actions/setup-deploy-ssh
        with:
          ssh_key: ${{ secrets.DEPLOY_SSH_KEY }}
          hosts: '43.130.6.44 23.101.202.65'

      - name: 并发部署 FFAI + AIxC Production
        run: |
          set -uo pipefail

          # 部署 FFAI Workspace Production（后台 + 日志加 [FFAI] 前缀）
          (
            ssh $DEPLOY_SSH_OPTS srvadmin@43.130.6.44 bash -s <<'FFAI_DEPLOY'
          export NVM_DIR="$HOME/.nvm"
          [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
          cd /srv/apps/ffworkspace
          CI=true bash scripts/deploy/deploy.sh production deploy
          FFAI_DEPLOY
          ) 2>&1 | sed 's/^/[FFAI] /' &
          FFAI_PID=$!

          # 部署 AIxC Workspace Production
          (
            ssh $DEPLOY_SSH_OPTS itadminaixc@23.101.202.65 bash -s <<'AIXC_DEPLOY'
          export NVM_DIR="$HOME/.nvm"
          [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
          cd /srv/apps/aixcworkspace
          sg docker -c 'CI=true bash scripts/deploy/deploy.sh production deploy'
          AIXC_DEPLOY
          ) 2>&1 | sed 's/^/[AIXC] /' &
          AIXC_PID=$!

          # 等两个都完成；任一失败整个 step 失败
          wait $FFAI_PID; FFAI_RC=$?
          wait $AIXC_PID; AIXC_RC=$?

          echo "===== 部署结果 ====="
          echo "FFAI Production exit: $FFAI_RC"
          echo "AIxC Production exit: $AIXC_RC"

          if [ $FFAI_RC -ne 0 ] || [ $AIXC_RC -ne 0 ]; then
            echo "❌ 至少一个目标部署失败"
            exit 1
          fi
          echo "✅ 两个生产目标全部部署成功"

  post-deploy-smoke:
    needs: deploy
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # L4 部署后：smoke test（健康检查 + 关键路径）
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup deploy SSH
        uses: ./.gitea/actions/setup-deploy-ssh
        with:
          ssh_key: ${{ secrets.DEPLOY_SSH_KEY }}
          hosts: '43.130.6.44'

      - name: Smoke test
        run: |
          DEPLOY_HOST="43.130.6.44"
          ssh $DEPLOY_SSH_OPTS srvadmin@"$DEPLOY_HOST" \
            'cd /srv/apps/ffworkspace && bash scripts/ops/smoke-test.sh production'
