deploy.yml

name: Deploy to Production

on:
  push:
    branches: [master]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag to deploy (leave empty for latest)'
        required: false
        type: string
        default: ''

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: vreshch/vreshch.com

jobs:
  build-and-push:
    name: 🐳 Build & Push Docker Image
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      image-tag: ${{ steps.set-tag.outputs.tag }}

    steps:
      - name: 📥 Checkout code
        uses: actions/checkout@v7

      - name: 🏷️ Determine image tag
        id: set-tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ inputs.tag }}" ]; then
            echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
            echo "📌 Using custom tag: ${{ inputs.tag }}"
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
            echo "📌 Using commit SHA: ${{ github.sha }}"
          fi

      - name: 🔐 Login to GitHub Container Registry
        uses: docker/login-action@v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🛠️ Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: 🐳 Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.set-tag.outputs.tag }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          build-args: |
            COMMIT_SHA=${{ github.sha }}
            BRANCH=${{ github.ref_name }}
            BUILD_TIME=${{ github.event.repository.updated_at }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    name: 🚀 Deploy to Server
    needs: build-and-push
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: production

    steps:
      - name: 📥 Checkout code
        uses: actions/checkout@v7

      - name: 🔧 Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts

          # Test SSH connection
          echo "Testing SSH connection..."
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no root@${{ secrets.SERVER_HOST }} "echo 'SSH connection successful'"

      - name: 📤 Copy deployment files to server
        run: |
          echo "📦 Ensuring remote directory exists..."
          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} "mkdir -p /opt/vreshch-com && chown root:root /opt/vreshch-com && chmod 755 /opt/vreshch-com"

          echo "📦 Copying docker-compose.yml..."
          scp -i ~/.ssh/deploy_key docker-compose.yml root@${{ secrets.SERVER_HOST }}:/opt/vreshch-com/

          echo "📦 Copying deployment script..."
          scp -i ~/.ssh/deploy_key scripts/deploy.sh root@${{ secrets.SERVER_HOST }}:/opt/vreshch-com/
          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} "chmod +x /opt/vreshch-com/deploy.sh"

      - name: 🔑 Write runtime env on server
        run: |
          echo "🔑 Writing /opt/vreshch-com/.env (runtime secrets)..."
          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} "install -m 600 /dev/stdin /opt/vreshch-com/.env" <<'ENV_EOF'
          RESEND_API_KEY=${{ secrets.RESEND_API_KEY }}
          # SigNoz tracing over the WG mesh; unset token would leave these blank = tracer off.
          OTEL_EXPORTER_OTLP_ENDPOINT=http://172.31.0.1:4318
          OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer%20${{ secrets.SIGNOZ_INGEST_TOKEN }}
          OTEL_SERVICE_NAME=vreshch-web
          OTEL_RESOURCE_ATTRIBUTES=deployment.environment=production,service.namespace=side
          OTEL_TRACES_SAMPLER=parentbased_traceidratio
          OTEL_TRACES_SAMPLER_ARG=1.0
          OTEL_METRICS_EXPORTER=none
          OTEL_LOGS_EXPORTER=none
          CONTACT_TO_EMAIL=vreshch@gmail.com
          CONTACT_FROM_EMAIL=Volodymyr Vreshch <no-reply@mail.agentage.io>
          ENV_EOF
          echo "✅ Runtime env written"

      - name: 🚀 Deploy application
        id: deploy
        run: |
          IMAGE_TAG="${{ needs.build-and-push.outputs.image-tag }}"

          echo "🚀 Deploying to production..."
          echo "📦 Image tag: ${IMAGE_TAG}"

          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} << EOF
            set -e
            cd /opt/vreshch-com
            
            # Authenticate with GHCR on server
            echo "🔐 Authenticating with GHCR..."
            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin

            # Update image tag in docker-compose
            sed -i "s|image:.*|image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}|g" docker-compose.yml

            # Pull new image before deploying
            echo "📥 Pulling image..."
            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}

            # Deploy to Docker Swarm
            echo "🐳 Deploying stack..."
            docker stack deploy -c docker-compose.yml vreshch --with-registry-auth

            # Force service update to ensure containers restart with new image
            echo "🔄 Forcing service update..."
            docker service update --force vreshch_web

            # Wait for deployment
            echo "⏳ Waiting for service to be ready..."
            sleep 15
            
            # Check service status
            echo "✅ Service status:"
            docker service ps vreshch_web --no-trunc --format "table {{.Name}}\t{{.CurrentState}}\t{{.Error}}"
            
            # Save deployed version
            echo "${IMAGE_TAG}" > .deployed-version
            echo "✅ Deployment complete!"
          EOF

      - name: ✅ Verify deployment
        run: |
          echo "🔍 Verifying deployment..."
          EXPECTED="${{ github.sha }}"
          for i in $(seq 1 30); do
            LIVE_COMMIT=$(curl -sf "https://vreshch.com/api/version" 2>/dev/null | jq -r '.commit // empty') || true
            if [ "$LIVE_COMMIT" = "$EXPECTED" ]; then
              echo "✅ Deployment verified! Live commit: $LIVE_COMMIT"
              exit 0
            fi
            echo "⏳ Attempt $i/30 — got: ${LIVE_COMMIT:-no response}, want: ${EXPECTED:0:8}"
            sleep 10
          done
          echo "❌ Deployment verification failed — live version does not match expected commit"
          exit 1

      - name: 🧹 Cleanup
        if: always()
        run: |
          rm -f ~/.ssh/deploy_key
          echo "🧹 Cleanup complete"

  deployment-summary:
    name: 📋 Deployment Summary
    needs: [build-and-push, deploy]
    if: always()
    runs-on: ubuntu-latest

    steps:
      - name: 📊 Generate summary
        uses: actions/github-script@v9
        env:
          # Pass via env, not string-interpolation: a backtick (or any special
          # char) in the commit message would otherwise break the inline script.
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        with:
          script: |
            const buildResult = '${{ needs.build-and-push.result }}';
            const deployResult = '${{ needs.deploy.result }}';
            const imageTag = '${{ needs.build-and-push.outputs.image-tag }}';
            const commitSha = '${{ github.sha }}';
            const commitMessage = process.env.COMMIT_MESSAGE || 'Manual deployment';
            const eventName = '${{ github.event_name }}';
            const triggerType = eventName === 'workflow_dispatch' ? 'Manual' : 'Automatic (push)';

            let status = '✅ SUCCESS';
            let emoji = '🎉';

            if (buildResult === 'failure') {
              status = '❌ FAILED - Build';
              emoji = '🔨';
            } else if (deployResult === 'failure') {
              status = '❌ FAILED - Deployment';
              emoji = '🚨';
            }

            const summary = `${emoji} **Deployment ${status}**

            **Commit:** \`${commitSha.substring(0, 8)}\`
            **Message:** ${commitMessage}
            **Branch:** master
            **Trigger:** ${triggerType}

            **Pipeline Results:**
            - 🐳 Build & Push: ${buildResult === 'success' ? '✅' : '❌'} ${buildResult}
            - 🚀 Deployment: ${deployResult === 'success' ? '✅' : '❌'} ${deployResult}

            **Details:**
            - **Image Tag:** \`${imageTag}\`
            - **Registry:** ghcr.io/vreshch/vreshch.com
            - **Server:** vreshch.com
            - **Deployment URL:** https://vreshch.com

            **Quick Actions:**
            - 📋 [Workflow Run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
            - 🌐 [Visit Website](https://vreshch.com)
            - 📦 [Registry](https://github.com/${{ github.repository }}/pkgs/container/vreshch.com)

            ---
            ⏰ Generated at: \`${new Date().toISOString()}\``;

            console.log(summary);

            // Create commit status
            try {
              await github.rest.repos.createCommitStatus({
                owner: context.repo.owner,
                repo: context.repo.repo,
                sha: commitSha,
                state: deployResult === 'success' ? 'success' : 'failure',
                target_url: `https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}`,
                description: `Deployment ${status}`,
                context: 'deployment/production'
              });
            } catch (error) {
              console.log('Could not create commit status:', error.message);
            }