name: Build and Deploy Lean

on:
  push:
    branches: [master]
    # This pipeline owns the lean editor image: heavy (it builds lean4web
    # with Mathlib), so it runs only when lean/** actually changes
    paths:
      - "lean/**"
  workflow_dispatch:

jobs:
  build:
    runs-on: docker

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install SSH client
        run: |
          apt-get update -y && apt-get install -y openssh-client

      - name: Setup SSH inside container
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

          # Add the container host to known_hosts
          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts

      - name: Log in to registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      # Multi-stage: compilers/dev deps stay in the builder, the pushed image
      # is the slim runtime (toolchain + client + Mathlib cache). Still a
      # heavy build and a multi-GB push — expect it to take a while.
      # Pin upstream with: docker build --build-arg LEAN4WEB_REF=v0.2.2 ...
      - name: Build lean editor server
        run: |
          docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest ./lean
          docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest

      - name: Deploy
        run: |
          ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
            echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
            cd /var/www/app/
            docker compose pull lean
            docker compose up -d lean
          EOF