name: Deploy to VPS (PAT over HTTPS)

on:
  push:
    branches: ["main"]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout (optional)
      uses: actions/checkout@v4

    - name: Deploy to VPS via SSH
      uses: appleboy/ssh-action@v1.0.0
      env:
        GIT_TOKEN: ${{ secrets.GIT_TOKEN }}   # <-- simpan PAT di sini (org-wide read-only)
      with:
        host: idc.upsense.co.id
        username: root
        port: 22
        key: ${{ secrets.SSH_KEY }}           # private key untuk SSH ke server
        script_stop: true
        envs: GIT_TOKEN                       # kirim env GIT_TOKEN ke sesi SSH
        script: |
          set -e
          PROJECT_DIR="/var/www/html/xpendify.upsense.co.id"
          REPO_HTTPS="https://github.com/upsense-id/TIA-Xpendify.git"
          # GIT_BRANCH dapat dioverride jika perlu:
          # export GIT_BRANCH="main"
          /root/deploy.sh "$PROJECT_DIR" "$REPO_HTTPS"