# ── Web: Staging ──────────────────────────────────────────────────────────────
# Triggered on every push to `staging`.
# Builds with --mode staging (uses .env.staging locally; CI uses secrets).
#
# Required Woodpecker secrets:
#   staging_url
#   staging_appwrite_endpoint
#   staging_appwrite_project_id
#   ssh_private_key
#   deploy_host
#   deploy_user
#   deploy_path
# ─────────────────────────────────────────────────────────────────────────────

when:
  - event: push
    branch: staging

steps:
  - name: build
    image: node:20-alpine
    environment:
      VITE_APP_URL:
        from_secret: staging_url
      VITE_APPWRITE_ENDPOINT:
        from_secret: staging_appwrite_endpoint
      VITE_APPWRITE_PROJECT_ID:
        from_secret: staging_appwrite_project_id
    commands:
      - npm ci
      - npm run build:staging -w @budgetwise/web

  - name: deploy
    image: alpine
    environment:
      SSH_PRIVATE_KEY:
        from_secret: ssh_private_key
      DEPLOY_HOST:
        from_secret: deploy_host
      DEPLOY_USER:
        from_secret: deploy_user
      DEPLOY_PATH:
        from_secret: deploy_path
    commands:
      - apk add --no-cache rsync openssh-client
      - eval $(ssh-agent -s)
      - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
      - mkdir -p ~/.ssh && chmod 700 ~/.ssh
      - ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts
      - rsync -avz --delete apps/web/dist/ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/staging/"