name: Deploy WP mu-plugin

# Déploie covalba-core sur le WP du VPS à CHAQUE merge sur main qui touche le
# mu-plugin → le VPS suit toujours main, plus de rsync manuel depuis une branche
# en retard (qui downgradait le schéma, cf. incident fiche-lieu/heroImage).
# Puis vérifie le schéma GraphQL (le job échoue si un champ attendu manque).
#
# Secrets requis (Settings → Secrets and variables → Actions) :
#   COVALBA_WP_SSH_KEY  : clé privée SSH (contenu de ~/.ssh/covalba_wp_ed25519)
#   COVALBA_WP_HOST     : 72.61.87.116
#   COVALBA_WP_USER     : root

on:
  push:
    branches: [main]
    paths:
      - 'wordpress/mu-plugins/**'
      - 'scripts/wp/check-graphql-schema.sh'
      - '.github/workflows/deploy-wp-muplugin.yml'

concurrency:
  group: deploy-wp-muplugin
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.COVALBA_WP_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${{ secrets.COVALBA_WP_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Rsync mu-plugin → VPS
        run: |
          rsync -az -e "ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new" \
            wordpress/mu-plugins/ \
            "${{ secrets.COVALBA_WP_USER }}@${{ secrets.COVALBA_WP_HOST }}:/srv/covalba-wp/wp-content/mu-plugins/"

      - name: Flush cache
        run: |
          ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new \
            "${{ secrets.COVALBA_WP_USER }}@${{ secrets.COVALBA_WP_HOST }}" \
            'cd /srv/covalba-wp && docker compose run --rm wpcli wp cache flush || true'

      - name: Verify GraphQL schema (fails on missing fields)
        run: |
          ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=accept-new \
            "${{ secrets.COVALBA_WP_USER }}@${{ secrets.COVALBA_WP_HOST }}" \
            'bash -s' < scripts/wp/check-graphql-schema.sh
