name: Deploy add-in task pane

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

env:
  AZURE_WEBAPP_NAME: wapd-mailagent-addin
  # Verify the DEPLOY TARGET is serving (default host), decoupled from the
  # custom domain (mailagent.workshopapd.com), which is set up separately
  # before Gate A. Checking the custom domain here would red the deploy until
  # DNS + cert exist.
  VERIFY_URL: https://wapd-mailagent-addin.azurewebsites.net/taskpane.html

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Azure login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy static task pane to Azure App Service
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}
          package: .

      - name: Verify task pane reachable
        run: |
          echo "Polling ${VERIFY_URL} until it returns HTTP 200..."
          for i in $(seq 1 30); do
            code=$(curl -s -o /dev/null -w "%{http_code}" "${VERIFY_URL}" || echo "000")
            echo "Attempt ${i}: HTTP ${code}"
            [ "${code}" = "200" ] && { echo "Task pane reachable."; exit 0; }
            sleep 10
          done
          echo "Task pane did not return 200 in time."
          exit 1
