# CI/CD — verify on every push, ship main when green.
#
# Runs on the act_runner registered on build-host (label `ubuntu-latest`, Docker-backed).
# Same shape as music.karti.ai: verify and deploy are two jobs in ONE workflow joined by
# `needs:`, because Gitea's cross-workflow triggers are less reliable than GitHub's. A red
# build cannot deploy.
#
# Requires one repo secret: CLOUD2_SSH_KEY — the private half of a deploy key whose public
# half is in ubuntu@web-host's authorized_keys.

name: CI

on:
  push:
    branches: ["**"]
  pull_request:
    branches: [main]
  workflow_dispatch:

env:
  CLOUD2_HOST: 100.92.185.76

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Harness imports and registry parses
        # Catches a malformed models.yaml or a broken target before it reaches
        # the site build, where the failure would be far less legible.
        run: |
          python3 -m pip install --quiet pyyaml
          python3 - <<'PY'
          import sys; sys.path.insert(0, '.')
          from kbench.registry import load_registry
          reg = load_registry()
          for t in reg.targets.values():
              t.inspect_model  # raises on an unserveable target
          print(f"registry ok: {len(reg.targets)} targets, {len(reg.hosts)} hosts")
          PY

      - name: Results files are valid and schema-consistent
        run: |
          python3 - <<'PY'
          import json, pathlib, sys
          bad = 0
          for p in sorted(pathlib.Path('results').glob('*.json')):
              d = json.loads(p.read_text())
              for field in ('run_id', 'timestamp', 'target_id', 'target', 'schema_version'):
                  if field not in d:
                      print(f"::error::{p.name} missing {field}"); bad += 1
          print(f"checked results files, {bad} problem(s)")
          sys.exit(1 if bad else 0)
          PY

      - name: Build site
        working-directory: site
        run: |
          npm install --no-audit --no-fund
          npm run build

  deploy:
    needs: verify
    # Gitea populates the **github** context, not a `gitea` one — `gitea.ref` silently
    # evaluates to nothing and the job is skipped with no error.
    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.CLOUD2_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H "$CLOUD2_HOST" >> ~/.ssh/known_hosts 2>/dev/null

      - name: Deploy to web-host
        run: |
          ssh -i ~/.ssh/deploy_key -o BatchMode=yes ubuntu@"$CLOUD2_HOST" bash -s <<'REMOTE'
          set -euo pipefail
          cd /home/ubuntu/workspace/bench.karti.ai
          git fetch origin -q
          git reset --hard origin/main -q
          cd site
          npm install --no-audit --no-fund
          npm run build
          sudo systemctl restart bench-karti
          REMOTE

      - name: Verify the deploy
        run: |
          for i in $(seq 1 20); do
            if curl -sf https://bench.karti.ai/api/health | grep -q '"ok":true'; then
              echo "✓ bench.karti.ai is healthy"
              exit 0
            fi
            sleep 3
          done
          echo "::error::bench.karti.ai did not come back healthy after deploy"
          ssh -i ~/.ssh/deploy_key -o BatchMode=yes ubuntu@"$CLOUD2_HOST" \
            'sudo journalctl -u bench-karti -n 40 --no-pager' || true
          exit 1