name: Deploy to Hugging Face Space (Docker)

# Pushes this repo to the HF Docker Space on every push to main.
# HF builds the image server-side from ./Dockerfile (app_port 7860).
#
# PREREQUISITE: create the Space first (huggingface.co/new-space > Docker SDK,
# name it e.g. BRIDGE_Modul-E_prod), then:
#
# Required setup (one-time, in GitHub > Settings > Secrets and variables):
#   Secrets > Actions > New repository secret:
#     HF_TOKEN = a Hugging Face write token (https://huggingface.co/settings/tokens)
#   Variables > Actions > New repository variable:
#     HF_SPACE_ID = e.g. sitcod3/BRIDGE_Modul-E_prod
#
# Space secrets (set in the Space > Settings > Variables and secrets):
#   VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY (as build-time secrets so the
#   Vite bundle is baked with them), SUPABASE_SERVICE_ROLE_KEY,
#   OPENROUTER_API_KEY, UPSTASH_REDIS_REST_URL, UPSTASH_REDIS_REST_TOKEN

on:
  push:
    branches:
      - main
  workflow_dispatch:

env:
  HF_SPACE_ID: ${{ vars.HF_SPACE_ID || 'sitcod3/BRIDGE_Modul-E_prod' }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          lfs: true

      - name: Push to Hugging Face Space
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          if [ -z "$HF_TOKEN" ]; then
            echo "::error::HF_TOKEN secret is not set (GitHub > Settings > Secrets and variables > Actions)"
            exit 1
          fi
          mkdir -p hf-space
          # Ship tracked files only (excludes node_modules, dist, .git, local .env)
          git archive HEAD | tar -x -C hf-space
          cd hf-space
          git config --global user.email "ci@fortydn.lab"
          git config --global user.name "FortyDN CI/CD"
          git init -b main
          git add .
          git commit -m "Deploy from GitHub Actions - $(date +'%Y-%m-%d %H:%M:%S')"
          HF_REMOTE="https://sitcod3:${HF_TOKEN}@huggingface.co/spaces/${HF_SPACE_ID}"
          for i in 1 2 3; do
            if git push --force "$HF_REMOTE" main; then
              echo "Push succeeded on attempt $i"
              break
            fi
            echo "Push attempt $i failed, retrying in 10s..."
            sleep 10
            if [ "$i" = "3" ]; then
              echo "::error::Failed to push to Hugging Face Space after 3 attempts"
              exit 1
            fi
          done

      - name: Verify Space is Running
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          for i in $(seq 1 12); do
            STAGE=$(curl -s -H "Authorization: Bearer ${HF_TOKEN}" \
              "https://huggingface.co/api/spaces/${HF_SPACE_ID}" | \
              grep -o '"stage":"[A-Z_]*"' | head -1 | cut -d'"' -f4 || echo "UNKNOWN")
            echo "Attempt $i: Space stage = $STAGE"
            if [ "$STAGE" = "RUNNING" ]; then
              echo "Space is RUNNING"
              break
            fi
            sleep 10
          done

      - name: Smoke-test the live API
        env:
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
        run: |
          HOST=$(curl -s -H "Authorization: Bearer ${HF_TOKEN}" \
            "https://huggingface.co/api/spaces/${HF_SPACE_ID}" | \
            grep -o '"host":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
          echo "Space host: $HOST"
          if [ -n "$HOST" ]; then
            echo "--- /api/health ---"
            curl -s -m 20 "$HOST/api/health" || echo "(health check unreachable - Space may still be building)"
          fi