# Woodpecker CI pipeline for co-op/docs — THIN on purpose.
#
# It does NOT re-implement the build. The repository's publishing layer is the
# single source of truth and this pipeline only wires it up:
#
#   publishing/requirements.txt  pinned MkDocs + Material toolchain
#   publishing/build.sh          stage Markdown -> .site-src/, render .site-build/
#   publishing/deploy.sh         push .site-build/ into the Cloudron Surfer app
#
# Any change to how the site is built belongs in publishing/, never here.
#
# Run model: MANUAL ONLY for now. The Gitea webhook that fires this on push is
# deliberately NOT wired yet — the Woodpecker instance must first be restricted
# (done), connected to Gitea via OAuth (pending, see the operator runbook), and
# proven by a manual run. Once those hold, add `push` to the `when` block below
# and register the webhook in Gitea.
#
# Secrets required (Woodpecker repo/org secret, name `cloudron_token`):
#   cloudron_token = the Cloudron API token used by publishing/deploy.sh
# Do not put credentials in this file.

when:
  - event: manual

steps:
  - name: install
    image: python:3.12-slim-bookworm
    commands:
      # Pinned toolchain — the same file publishing/build.sh installs into its
      # own .venv-docs. We pre-create that venv so build.sh reuses it verbatim.
      - python3 -m venv .venv-docs
      - .venv-docs/bin/pip install --quiet --upgrade pip
      - .venv-docs/bin/pip install --quiet -r publishing/requirements.txt

  - name: build
    image: python:3.12-slim-bookworm
    commands:
      # Reuses .venv-docs created above; build.sh only installs if it is missing.
      - publishing/build.sh

  - name: deploy
    image: node:20-bookworm-slim
    commands:
      # deploy.sh drives the Cloudron `cloudron` CLI (a node script) via
      # `cloudron exec`; it needs node, the CLI, bash, git and tar.
      - apt-get update
      - apt-get install -y --no-install-recommends bash git tar ca-certificates
      - npm install -g cloudron
      # Deploy the build produced by the `build` step above (shared workspace).
      - publishing/deploy.sh
    environment:
      CLOUDRON_TOKEN:
        from_secret: cloudron_token