steps:
  ssh-test:
    image: google/cloud-sdk:latest
    entrypoint: ["bash", "-c"]
    commands: |
      set -euo pipefail

      mkdir -p ~/.ssh

      gcloud secrets versions access latest \
        --secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
        | base64 -d > ~/.ssh/known_hosts
      chmod 644 ~/.ssh/known_hosts

      gcloud secrets versions access latest \
        --secret=STAGING_SSH_KEY --project=aptivaai-dev \
        | base64 -d > ~/.ssh/id_ed25519
      chmod 600 ~/.ssh/id_ed25519

      echo "🔑 SSH prerequisites installed"

      TAG=$(echo "${CI_COMMIT_SHA:-$DRONE_COMMIT_SHA}" | head -c 8)
      echo "🚀 Deploying tag ${TAG} to staging"

      ssh -o StrictHostKeyChecking=yes \
          -i ~/.ssh/id_ed25519 \
          jcoakley@10.128.0.12 \
          "set -euo pipefail; \
           cd /opt/aptiva-staging-app; \
           echo 'Pulling containers'; \
           IMG_TAG=${TAG} docker compose pull; \
           echo 'Re‑creating services'; \
           IMG_TAG=${TAG} docker compose up -d --force-recreate --remove-orphans; \
           echo '✅ Staging stack refreshed with tag ${TAG}'"