name: Rebuild & Deploy
on:
  push:
    branches: [master]
    paths-ignore: ['*.md']
jobs:
  rebuild:
    runs-on: unraid
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Build images
        run: |
          docker build -t hope-voice-api-voice:latest .
          docker build -f control.Dockerfile -t hope-voice-control:latest .
          docker build -f hermes-webui.Dockerfile -t hope-hermes-webui:62e4d7b .
      - name: Deploy using protected persistent runtime configuration
        run: |
          # Credentials, account DB, certificates and per-user homes are outside
          # the CI checkout. This script never destroys or reinitializes them.
          test -f /mnt/user/appdata/hope-voice/runtime.env
          bash scripts/deploy-unraid.sh
      - name: Verify authenticated deployment
        run: |
          # CI runner loopback is not the Docker host's loopback.
          host_curl() {
            docker run --rm --network host --entrypoint curl hope-voice-api-voice:latest "$@"
          }
          host_curl -sf http://127.0.0.1:8092/health -o /dev/null
          host_curl -sfk https://127.0.0.1:9178/ -o /dev/null
          test "$(host_curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401