steps:
  ssh-test:                     # keep the name, keep the image
    image: google/cloud-sdk:latest
    commands:
      - |
        #!/usr/bin/env bash
        set -euo pipefail

        mkdir -p ~/.ssh

        # ── Install known‑hosts from Secret Manager ─────────────────
        gcloud secrets versions access latest \
          --secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
          | base64 -d > ~/.ssh/known_hosts
        chmod 644 ~/.ssh/known_hosts

        # ── Install private key ────────────────────────────────────
        gcloud secrets versions access latest \
          --secret=STAGING_SSH_KEY --project=aptivaai-dev \
          | base64 -d > ~/.ssh/id_ed25519
        chmod 600 ~/.ssh/id_ed25519

        echo "🔑  SSH prerequisites installed"

        # ── Tag = first 8 chars of the commit SHA that triggered CI ─
        TAG=$(echo "${CI_COMMIT_SHA:-$DRONE_COMMIT_SHA}" | head -c 8)
        echo "🚀  Deploying tag ${TAG} to staging"

        # ── SSH into the staging VM and refresh the stack ──────────
        ssh -o StrictHostKeyChecking=yes \
            -i ~/.ssh/id_ed25519 \
            jcoakley@10.128.0.12 \
            "set -euo pipefail; \
             cd /opt/aptiva-staging-app; \
             echo 'Pulling containers'; \
             IMG_TAG=${TAG} docker compose pull; \
             echo 'Re‑creating services'; \
             IMG_TAG=${TAG} docker compose up -d --force-recreate --remove-orphans; \
             echo '✅  Staging stack refreshed with tag ${TAG}'"