name: Deploy production
on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    # Manual runs must also select main before receiving production credentials.
    if: ${{ github.ref == 'refs/heads/main' }}
    # Match the label of tencent-prod-runner on server B, not its runner name.
    runs-on: tencent-prod
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4
        with:
          persist-credentials: false
      - name: Build, migrate and deploy
        shell: bash
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }}
          WQ_EMAIL: ${{ secrets.WQ_EMAIL }}
          WQ_PASSWORD: ${{ secrets.WQ_PASSWORD }}
          ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
          ADMIN_USERNAME: ${{ vars.ADMIN_USERNAME }}
          PUBLIC_ORIGIN: ${{ vars.PUBLIC_ORIGIN }}
          MCP_ENABLED: ${{ vars.MCP_ENABLED }}
        run: bash scripts/deploy-production.sh