deploy-dev.yml

name: Deploy to Dev

on:
  push:
    branches:
      - main
    paths:
      - "backend/**"
      - "frontend/**"
      - "deploy/**"
      - "nginx/**"
      - "docs/openapi/**"
      - "docs/swagger-ui/**"
      - ".github/workflows/deploy-dev.yml"
  release:
    types:
      - published
  workflow_dispatch:

concurrency:
  group: deploy-dev-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build-backend:
    name: Build and Push Backend Image
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: docker/build-push-action@v6
        with:
          context: ./backend
          platforms: linux/amd64
          push: true
          tags: |
            ${{ secrets.DOCKERHUB_NAMESPACE }}/sem-backend-dev:${{ github.sha }}
            ${{ secrets.DOCKERHUB_NAMESPACE }}/sem-backend-dev:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-frontend:
    name: Build and Push Frontend Image
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: docker/build-push-action@v6
        with:
          context: ./frontend
          platforms: linux/amd64
          push: true
          tags: |
            ${{ secrets.DOCKERHUB_NAMESPACE }}/sem-frontend-dev:${{ github.sha }}
            ${{ secrets.DOCKERHUB_NAMESPACE }}/sem-frontend-dev:latest
          build-args: |
            VITE_GOOGLE_MAPS_WEB_API_KEY=${{ secrets.FRONTEND_GOOGLE_MAPS_API_KEY }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    name: Deploy to Dev Server
    needs:
      - build-backend
      - build-frontend
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      DOCKERHUB_NAMESPACE: ${{ secrets.DOCKERHUB_NAMESPACE }}
      IMAGE_TAG: ${{ github.sha }}
      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
      JWT_SECRET: ${{ secrets.JWT_SECRET }}
      NEW_RELIC_LICENSE_KEY: ${{ secrets.NEW_RELIC_LICENSE_KEY }}
      RESEND_CLIENT_API_KEY: ${{ secrets.RESEND_CLIENT_API_KEY }}
      SPACES_ACCESS_KEY: ${{ secrets.SPACES_ACCESS_KEY }}
      SPACES_SECRET_KEY: ${{ secrets.SPACES_SECRET_KEY }}
      SPACES_ENDPOINT: ${{ secrets.SPACES_ENDPOINT }}
      SPACES_BUCKET: ${{ secrets.SPACES_BUCKET }}
      SPACES_CDN_BASE_URL: ${{ secrets.SPACES_CDN_BASE_URL }}
      SPACES_S3_REGION: ${{ secrets.SPACES_S3_REGION }}
      FIREBASE_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_JSON_BASE64 }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4

      - name: Prepare remote directories and environment file
        uses: appleboy/ssh-action@v1.2.0
        env:
          DOCKERHUB_NAMESPACE: ${{ env.DOCKERHUB_NAMESPACE }}
          IMAGE_TAG: ${{ env.IMAGE_TAG }}
          DB_PASSWORD: ${{ env.DB_PASSWORD }}
          JWT_SECRET: ${{ env.JWT_SECRET }}
          NEW_RELIC_LICENSE_KEY: ${{ env.NEW_RELIC_LICENSE_KEY }}
          RESEND_CLIENT_API_KEY: ${{ env.RESEND_CLIENT_API_KEY }}
          SPACES_ACCESS_KEY: ${{ env.SPACES_ACCESS_KEY }}
          SPACES_SECRET_KEY: ${{ env.SPACES_SECRET_KEY }}
          SPACES_ENDPOINT: ${{ env.SPACES_ENDPOINT }}
          SPACES_BUCKET: ${{ env.SPACES_BUCKET }}
          SPACES_CDN_BASE_URL: ${{ env.SPACES_CDN_BASE_URL }}
          SPACES_S3_REGION: ${{ env.SPACES_S3_REGION }}
          FIREBASE_SERVICE_ACCOUNT_JSON_BASE64: ${{ env.FIREBASE_SERVICE_ACCOUNT_JSON_BASE64 }}
        with:
          host: ${{ secrets.SSH_DEV_IP_ADDRESS }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          envs: DOCKERHUB_NAMESPACE,IMAGE_TAG,DB_PASSWORD,JWT_SECRET,NEW_RELIC_LICENSE_KEY,RESEND_CLIENT_API_KEY,SPACES_ACCESS_KEY,SPACES_SECRET_KEY,SPACES_ENDPOINT,SPACES_BUCKET,SPACES_CDN_BASE_URL,SPACES_S3_REGION,FIREBASE_SERVICE_ACCOUNT_JSON_BASE64
          script: |
            set -eu

            env_file=/opt/sem/deploy/.env

            append_env() {
              printf '%s=%s\n' "$1" "$2" >> "$env_file"
            }

            sudo mkdir -p /opt/sem/deploy /opt/sem/nginx /opt/sem/docs
            sudo chown -R "$(id -un)":"$(id -gn)" /opt/sem

            install -m 600 /dev/null "$env_file"
            append_env DOCKERHUB_NAMESPACE "$DOCKERHUB_NAMESPACE"
            append_env IMAGE_TAG "$IMAGE_TAG"
            append_env DB_PASSWORD "$DB_PASSWORD"
            append_env JWT_SECRET "$JWT_SECRET"
            append_env NEW_RELIC_LICENSE_KEY "$NEW_RELIC_LICENSE_KEY"
            append_env RESEND_CLIENT_API_KEY "$RESEND_CLIENT_API_KEY"
            append_env SPACES_ACCESS_KEY "$SPACES_ACCESS_KEY"
            append_env SPACES_SECRET_KEY "$SPACES_SECRET_KEY"
            append_env SPACES_ENDPOINT "$SPACES_ENDPOINT"
            append_env SPACES_BUCKET "$SPACES_BUCKET"
            append_env SPACES_CDN_BASE_URL "$SPACES_CDN_BASE_URL"
            append_env SPACES_S3_REGION "$SPACES_S3_REGION"
            append_env FIREBASE_SERVICE_ACCOUNT_JSON_BASE64 "$FIREBASE_SERVICE_ACCOUNT_JSON_BASE64"

      - name: Upload Docker Compose definition
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.SSH_DEV_IP_ADDRESS }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          source: deploy/docker-compose.dev.yml
          target: /opt/sem/deploy
          strip_components: 1

      - name: Upload Nginx configuration
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.SSH_DEV_IP_ADDRESS }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          source: nginx/nginx.dev.conf
          target: /opt/sem/nginx
          strip_components: 1

      - name: Upload API documentation assets
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.SSH_DEV_IP_ADDRESS }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          source: docs/openapi,docs/swagger-ui
          target: /opt/sem

      - name: Pull images and restart services
        uses: appleboy/ssh-action@v1.2.0
        env:
          DOCKERHUB_USERNAME: ${{ env.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ env.DOCKERHUB_TOKEN }}
        with:
          host: ${{ secrets.SSH_DEV_IP_ADDRESS }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          envs: DOCKERHUB_USERNAME,DOCKERHUB_TOKEN
          script: |
            set -eu

            cd /opt/sem
            compose_cmd="docker compose -f deploy/docker-compose.dev.yml"

            wait_for_container_running() {
              container_name="$1"
              attempts="$2"
              for attempt in $(seq 1 "$attempts"); do
                container_id="$($compose_cmd ps -q "$container_name" || true)"
                if [ -n "$container_id" ] && [ "$(docker inspect --format '{{.State.Running}}' "$container_id")" = "true" ]; then
                  printf '%s\n' "$container_id"
                  return 0
                fi
                sleep 2
              done
              return 1
            }

            echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
            $compose_cmd config -q
            test -f docs/swagger-ui/index.html
            test -f docs/openapi/auth.yaml

            postgres_id="$($compose_cmd ps -q postgres || true)"
            if [ -n "$postgres_id" ] && [ "$(docker inspect --format '{{.State.Running}}' "$postgres_id")" = "true" ]; then
              echo "postgres is already running; skipping pull and restart"
            else
              $compose_cmd up -d postgres
              postgres_id="$($compose_cmd ps -q postgres)"
              if [ -z "$postgres_id" ]; then
                echo "postgres container could not be resolved" >&2
                exit 1
              fi
            fi

            for attempt in $(seq 1 30); do
              health="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}' "$postgres_id")"
              if [ "$health" = "healthy" ]; then
                break
              fi
              if [ "$health" = "unhealthy" ]; then
                docker logs "$postgres_id"
                exit 1
              fi
              sleep 2
            done

            health="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}no-healthcheck{{end}}' "$postgres_id")"
            if [ "$health" != "healthy" ]; then
              echo "postgres did not become healthy in time" >&2
              docker logs "$postgres_id"
              exit 1
            fi

            $compose_cmd pull backend frontend
            $compose_cmd up -d --no-deps backend frontend

            backend_id="$(wait_for_container_running backend 30)" || {
              echo "backend container did not reach running state" >&2
              exit 1
            }
            frontend_id="$(wait_for_container_running frontend 30)" || {
              echo "frontend container did not reach running state" >&2
              exit 1
            }

            $compose_cmd up -d nginx

            nginx_id="$(wait_for_container_running nginx 30)" || {
              echo "nginx container did not reach running state" >&2
              exit 1
            }
            docker exec "$nginx_id" nginx -t
            docker exec "$nginx_id" nginx -s reload

            for attempt in $(seq 1 30); do
              if docker exec "$nginx_id" wget -q -O /dev/null http://backend:8080/health; then
                break
              fi
              if [ "$attempt" -eq 30 ]; then
                echo "backend post-deploy health check failed" >&2
                docker logs "$backend_id"
                exit 1
              fi
              sleep 2
            done

            for attempt in $(seq 1 30); do
              if docker exec "$nginx_id" wget -q -O /dev/null http://frontend/; then
                break
              fi
              if [ "$attempt" -eq 30 ]; then
                echo "frontend post-deploy health check failed" >&2
                docker logs "$frontend_id"
                exit 1
              fi
              sleep 2
            done

            for attempt in $(seq 1 30); do
              if docker exec "$nginx_id" wget -q -O /dev/null --no-check-certificate https://127.0.0.1/api/health && \
                 docker exec "$nginx_id" wget -q -O /dev/null --no-check-certificate https://127.0.0.1/; then
                break
              fi
              if [ "$attempt" -eq 30 ]; then
                echo "nginx ingress smoke check failed" >&2
                docker logs "$nginx_id"
                exit 1
              fi
              sleep 2
            done

            for attempt in $(seq 1 30); do
              if docker exec "$nginx_id" wget -q -O /dev/null --no-check-certificate https://127.0.0.1/api/docs/ && \
                 docker exec "$nginx_id" wget -q -O /dev/null --no-check-certificate https://127.0.0.1/api/docs/openapi/auth.yaml; then
                break
              fi
              if [ "$attempt" -eq 30 ]; then
                echo "swagger docs ingress smoke check failed" >&2
                docker logs "$nginx_id"
                exit 1
              fi
              sleep 2
            done

            docker image prune -af --filter "until=72h" || true
            $compose_cmd ps