# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [20, 22]

    steps:
      - name: 检出代码
        uses: actions/checkout@v4

      - name: 设置 Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: 安装依赖
        run: npm ci

      - name: 代码检查
        run: npm run lint

      - name: 类型检查（如有 TypeScript）
        run: npm run typecheck
        continue-on-error: true

      - name: 运行测试
        run: npm test -- --coverage

      - name: 上传覆盖率报告
        if: matrix.node-version == 22
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

    steps:
      - uses: actions/checkout@v4

      # 方式 1：setup-node 内置缓存
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'

      # 方式 2：手动缓存
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # === 阶段 1：测试 ===
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npm run lint
      - run: npm test

  # === 阶段 2：构建并推送 Docker 镜像 ===
  build:
    needs: test  # 测试通过后才执行
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}

    steps:
      - uses: actions/checkout@v4

      - name: 登录 GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 提取镜像元数据
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=raw,value=latest

      - name: 构建并推送镜像
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # === 阶段 3：部署到服务器 ===
  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: 部署到服务器
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /opt/my-app
            docker compose pull
            docker compose up -d
            docker system prune -f

# .github/workflows/pr-check.yml
name: PR Check

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npm run lint -- --format=json --output-file=eslint-report.json
        continue-on-error: true

      - name: 代码检查结果
        if: always()
        uses: github/codeql-action/upload-sarif@v3

      - name: 运行测试
        run: npm test -- --ci --reporters=default --reporters=jest-junit
        env:
          JEST_JUNIT_OUTPUT_DIR: ./reports

      - name: 测试报告
        if: always()
        uses: dorny/test-reporter@v1
        with:
          name: Test Results
          path: reports/junit.xml
          reporter: jest-junit

      - name: 蓝绿部署
        run: |
          # 获取当前运行的颜色
          CURRENT=$(ssh $SERVER "cat /opt/app/color" || echo "blue")
          if [ "$CURRENT" = "blue" ]; then
            NEW="green"
            PORT_NEW=3001
          else
            NEW="blue"
            PORT_NEW=3000
          fi

          # 部署新版本
          ssh $SERVER "
            docker pull $IMAGE:${{ github.sha }}
            docker run -d --name app-$NEW -p $PORT_NEW:3000 $IMAGE:${{ github.sha }}
            sleep 10

            # 健康检查
            curl -f http://localhost:$PORT_NEW/health

            # 切换 Nginx
            sed -i 's/localhost:.*/localhost:$PORT_NEW/' /etc/nginx/conf.d/app.conf
            nginx -s reload

            # 停止旧版本
            docker stop app-$CURRENT && docker rm app-$CURRENT
            echo $NEW > /opt/app/color
          "

# 在 GitHub 仓库设置中添加 Secrets
# Settings → Secrets and variables → Actions

# 使用 Secrets
jobs:
  deploy:
    steps:
      - name: 部署
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          API_KEY: ${{ secrets.API_KEY }}
          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          echo "部署中..."