deploy.yml

name: Build & Deploy

on:
  push:
    branches: [main]
    tags: ['v*']
  workflow_dispatch:

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE: ghcr.io/${{ github.repository }}

jobs:
  build-and-push:
    name: Build & push image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract image metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,format=short
            type=semver,pattern={{version}}

      - name: Build and push
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    name: Redeploy on Portainer
    needs: build-and-push
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    # Primary CD is Portainer's git polling (the stack pulls this repo every 5m and
    # redeploys on new commits). This job is a best-effort fast-path that pushes the
    # redeploy immediately; it is allowed to fail when the Portainer host sits behind
    # a WAF that blocks GitHub-hosted runner IPs.
    continue-on-error: true
    steps:
      - name: Trigger Portainer git redeploy
        env:
          PORTAINER_URL: ${{ secrets.PORTAINER_URL }}
          PORTAINER_API_KEY: ${{ secrets.PORTAINER_API_KEY }}
          STACK_ID: ${{ secrets.PORTAINER_STACK_ID }}
          ENDPOINT_ID: ${{ secrets.PORTAINER_ENDPOINT_ID }}
        run: |
          set -euo pipefail

          # The stack is deployed from this Git repository and built on the host.
          # Re-pull the latest commit and rebuild, preserving the stack's stored
          # environment (which holds SESSION_SECRET) so no secrets are handled here.
          env_json=$(curl -fsS -H "X-API-Key: $PORTAINER_API_KEY" \
            "$PORTAINER_URL/api/stacks/$STACK_ID" | jq -c '.Env // []')

          jq -n --argjson env "$env_json" \
            '{env: $env, prune: true, pullImage: false}' > payload.json

          curl -fsS -X PUT \
            -H "X-API-Key: $PORTAINER_API_KEY" \
            -H "Content-Type: application/json" \
            "$PORTAINER_URL/api/stacks/$STACK_ID/git/redeploy?endpointId=$ENDPOINT_ID" \
            --data @payload.json > /dev/null

          echo "Portainer stack $STACK_ID redeployed from latest commit."