password_manager/.gitea/workflows/deploy.yml

name: Test, Build & Deploy

# Tests + build run on every push/PR; the deploy (WebDAV publish of the
# single-file dist/index.html) runs only on the default branch (main).
"on":
  push:
    branches:
      - '**'
  pull_request:

jobs:
  test-and-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm run test:run

      - name: Build (single-file bundle)
        env:
          VITE_COMMIT_HASH: ${{ github.sha }}
        run: npm run build

      - name: Verify build output
        run: test -f dist/index.html

  deploy:
    # Release the built app only when a commit lands on the default branch.
    needs: test-and-build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Build (single-file bundle)
        env:
          VITE_COMMIT_HASH: ${{ github.sha }}
        run: npm run build

      - name: Verify build output
        run: test -f dist/index.html

      # Publish index.html + PWA companion files (manifest, sandbox service
      # worker, icons) to the WebDAV mirror. The pretty URL
      # (…/password_manager/index.html) 401s without auth; files live at
      # www/static/password_manager/<name> with basic auth.
      - name: Publish to WebDAV (/password_manager)
        env:
          WEBDAV_USER: ${{ secrets.WEBDAV_USER }}
          WEBDAV_PASS: ${{ secrets.WEBDAV_PASS }}
          WEBDAV_BASE: https://files.thecookiejar.me/www/static/password_manager
        run: |
          set -e
          if [ -z "$WEBDAV_USER" ] || [ -z "$WEBDAV_PASS" ]; then
            echo "::error::WEBDAV_USER / WEBDAV_PASS repo secrets are not set."
            echo "::error::Add them under Settings -> Actions -> Secrets, then re-run this job."
            exit 1
          fi
          publish() {
            local src="$1" dst="$2" ctype="$3"
            # DELETE-then-PUT: the serving layer caches uploaded files, so a plain
            # PUT over an existing file keeps serving the OLD copy.
            curl -sS -u "$WEBDAV_USER:$WEBDAV_PASS" -X DELETE "$dst" || echo "(DELETE non-zero; may be a new file -- continuing)"
            curl -sS --fail -u "$WEBDAV_USER:$WEBDAV_PASS" -X PUT -T "$src" -H "Content-Type: $ctype" "$dst"
            echo "Published $src -> $dst"
          }
          # Ensure the icons/ subfolder exists.
          curl -sS -u "$WEBDAV_USER:$WEBDAV_PASS" -X MKCOL "$WEBDAV_BASE/icons" -o /dev/null || echo "(icons dir exists or MKCOL unsupported -- continuing)"
          publish dist/index.html                 "$WEBDAV_BASE/index.html"              'text/html'
          publish dist/manifest.webmanifest       "$WEBDAV_BASE/manifest.webmanifest"    'application/manifest+json'
          publish dist/sw.js                      "$WEBDAV_BASE/sw.js"                   'application/javascript; charset=utf-8'
          publish dist/icons/icon-192.png         "$WEBDAV_BASE/icons/icon-192.png"      'image/png'
          publish dist/icons/icon-512.png         "$WEBDAV_BASE/icons/icon-512.png"      'image/png'
          publish dist/icons/icon-maskable-512.png "$WEBDAV_BASE/icons/icon-maskable-512.png" 'image/png'

      # Pull the freshly uploaded files back and compare bytes, so a successful
      # deploy isn't just "curl returned 0" but the served copy actually matches.
      - name: Verify deployed files match build
        env:
          WEBDAV_USER: ${{ secrets.WEBDAV_USER }}
          WEBDAV_PASS: ${{ secrets.WEBDAV_PASS }}
          WEBDAV_BASE: https://files.thecookiejar.me/www/static/password_manager
        run: |
          set -e
          verify() {
            local src="$1" dst="$2"
            curl -sS --fail -u "$WEBDAV_USER:$WEBDAV_PASS" "$dst" -o "/tmp/deployed_$(basename "$src")"
            sha1sum "$src" "/tmp/deployed_$(basename "$src")"
            test "$(sha1sum "$src" | cut -d' ' -f1)" = \
                 "$(sha1sum "/tmp/deployed_$(basename "$src")" | cut -d' ' -f1)" \
              || { echo "::error::Deployed $src does not match build"; exit 1; }
            echo "Verified $src bytes match"
          }
          verify dist/index.html            "$WEBDAV_BASE/index.html"
          verify dist/manifest.webmanifest  "$WEBDAV_BASE/manifest.webmanifest"
          verify dist/sw.js                 "$WEBDAV_BASE/sw.js"
          verify dist/icons/icon-192.png    "$WEBDAV_BASE/icons/icon-192.png"
          verify dist/icons/icon-512.png    "$WEBDAV_BASE/icons/icon-512.png"
          verify dist/icons/icon-maskable-512.png "$WEBDAV_BASE/icons/icon-maskable-512.png"
          echo "All deployed files verified"