name: Deploy

# Deploy on every push to master (and allow manual runs from the Actions tab).
on:
  push:
    branches: [master]
  workflow_dispatch:

jobs:
  deploy:
    # `node` => node:22-bookworm (small, fast). We install the docker CLI below.
    # Requires the runner to mount /var/run/docker.sock into jobs (see repo docs).
    runs-on: node
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # The `node:22-bookworm` job image has the Docker socket mounted but not
      # the docker CLI. Install just the static client binary so `docker ...`
      # commands can talk to the host's Docker daemon.
      - name: Install Docker CLI
        run: |
          if ! command -v docker >/dev/null 2>&1; then
            curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
              | tar -xz -C /usr/local/bin --strip-components=1 docker/docker
          fi
          docker version

      # Build the site into an nginx image (see Dockerfile). Tagged with the
      # commit SHA for traceability, plus :latest for convenience.
      - name: Build image
        run: |
          docker build -t altricade-portfolio:${{ github.sha }} -t altricade-portfolio:latest .

      # Replace the running container with the freshly built image.
      # It joins the `proxy` network (the one Nginx Proxy Manager is on), so
      # NPM can reach it by container name — no published host port needed.
      # In NPM, forward to:  hostname = altricade-portfolio , port = 80 , http
      - name: Deploy container
        run: |
          docker rm -f altricade-portfolio 2>/dev/null || true
          docker run -d \
            --name altricade-portfolio \
            --restart unless-stopped \
            --network proxy \
            altricade-portfolio:latest

      # Free disk on the shared runner by dropping old, untagged images.
      - name: Prune old images
        run: docker image prune -f