name: Deploy legacy snapshot worker
on:
  workflow_dispatch:
    inputs:
      promote:
        description: "false = candidate only; true = promote to production worker"
        type: boolean
        default: false
      force_pdf_refresh:
        description: "true = re-fetch + re-upload the 1.3 PDF even if it already exists in R2"
        type: boolean
        default: false
permissions:
  contents: read
# Never cancel a mid-flight deploy — queue behind it instead (fleet parity).
concurrency:
  group: legacy-deploy
  cancel-in-progress: false
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { persist-credentials: false }
      - uses: actions/checkout@v4
        with: { repository: vyos/vyos-documentation, ref: rolling, path: docsrepo, persist-credentials: false }
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      # Runs BEFORE the Worker deploy (fail fast): if the PDF can't be fetched, validated,
      # and secured in R2, no Worker goes live — otherwise a promote=true run could leave
      # production serving HTML whose legacy-PDF link 404s, violating the spec §5 site+PDF
      # consistency invariant the main pipeline enforces.
      - name: Upload legacy 1.3 PDF to R2 (apex §5 fallback source)
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN_DOCS }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          set -eu
          cd docsrepo/workers && npm ci   # the Deploy step's own npm ci re-run is a fast no-op

          R2_KEY="vyos-docs-artifacts/legacy/1.3/vyos-documentation.pdf"
          # 1.2/1.3 are frozen (spec §15a) — once the PDF is seeded in R2 it never
          # changes, and after RTD sunsets, docs.vyos.io/_/downloads/... is gone, so
          # re-dispatching this workflow must not depend on re-fetching it. Probe
          # existence first (wrangler r2 has no head-only verb; `get --pipe` is the
          # cheapest existence check the CLI exposes) and skip fetch+upload on a hit.
          if [ '${{ inputs.force_pdf_refresh }}' != 'true' ] && \
             npx wrangler r2 object get "$R2_KEY" --remote --pipe >/dev/null 2>/tmp/r2-probe.log; then
            echo "PDF already present at $R2_KEY — skipping fetch+upload (force_pdf_refresh=false)"
            exit 0
          fi

          # r2-staging/ (tools/snapshot.sh's local output) is gitignored, so CI re-fetches
          # from the pre-sunset RTD source directly. Browser-UA + retry added defensively:
          # tools/snapshot.sh's wget mirror crawl needed a browser UA to pass Cloudflare's
          # managed challenge, while its own PDF curl needed neither locally — but CI's
          # IP/request pattern differs, so both guards are cheap insurance here.
          # 29.2 MiB > the 25 MiB Worker per-asset cap, so this artifact never lands in
          # the deploy's dist/assets/ below — it goes straight to the shared
          # vyos-docs-artifacts R2 bucket the apex Worker's DOCS_PDFS binding reads
          # (workers/apex/wrangler.jsonc in vyos-documentation, both envs).
          curl -fL --retry 5 --retry-delay 5 \
               --user-agent "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36" \
               "https://docs.vyos.io/_/downloads/en/1.3/pdf/" -o /tmp/vyos-documentation-1.3.pdf

          size=$(stat -c%s /tmp/vyos-documentation-1.3.pdf)
          min=$((25*1024*1024)); max=$((35*1024*1024))
          if [ "$size" -le "$min" ] || [ "$size" -ge "$max" ]; then
            echo "PDF size sanity check FAILED: got $size bytes, expected strictly between $min and $max bytes (25-35 MiB)"
            exit 1
          fi
          echo "PDF size OK: $size bytes"

          header=$(head -c 5 /tmp/vyos-documentation-1.3.pdf)
          if [ "$header" != "%PDF-" ]; then
            echo "PDF content validation FAILED: file does not start with %PDF- (got: $header)"
            exit 1
          fi
          echo "PDF content OK: %PDF- header present"

          npx wrangler r2 object put "$R2_KEY" \
            --file /tmp/vyos-documentation-1.3.pdf --remote
      - name: Deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN_DOCS }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          set -eu
          mkdir -p docsrepo/dist/assets && cp -r snapshot/. docsrepo/dist/assets/
          cd docsrepo/workers && npm ci
          name="vyos-docs-legacy$( [ '${{ inputs.promote }}' = 'true' ] || echo '-candidate' )"
          envv="$( [ '${{ inputs.promote }}' = 'true' ] && echo production || echo canary )"
          npx wrangler deploy --config branch/wrangler.legacy.jsonc \
            --name "$name" --var DOCS_BUILD_SHA:'${{ github.sha }}' --var DOCS_ENV:"$envv"