deploy-tailscale.yml

name: Deploy via Tailscale

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: false

env:
  DEPLOY_DIR: /opt/banktracker/BankTrackerGraphQL

jobs:
  detect-changes:
    name: Detect Changed Files
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      has_app_changes: ${{ steps.filter.outputs.backend == 'true' || steps.filter.outputs.frontend == 'true' || steps.filter.outputs.compose == 'true' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Check for file changes
        uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            backend:
              - 'PhantomDave.BankTracking.Api/**'
              - 'PhantomDave.BankTracking.Data/**'
              - 'PhantomDave.BankTracking.Library/**'
              - 'Dockerfile'
              - '.github/workflows/build-backend-image.yml'
            frontend:
              - 'frontend/**'
              - '.github/workflows/build-frontend-image.yml'
            compose:
              - 'compose.yaml'
              - 'compose.local.yaml'

  wait-for-backend:
    name: Wait for Backend Image
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.backend == 'true'
    permissions:
      actions: read
    steps:
      - name: Wait for backend image build
        uses: lewagon/wait-on-check-action@v1.4.1
        with:
          ref: ${{ github.sha }}
          check-name: 'Build and Push Backend Container'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 10
          running-workflow-name: 'Deploy via Tailscale'

  wait-for-frontend:
    name: Wait for Frontend Image
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.frontend == 'true'
    permissions:
      actions: read
    steps:
      - name: Wait for frontend image build
        uses: lewagon/wait-on-check-action@v1.4.1
        with:
          ref: ${{ github.sha }}
          check-name: 'Build and Push Frontend Container'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 10
          running-workflow-name: 'Deploy via Tailscale'

  deploy:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [detect-changes, wait-for-backend, wait-for-frontend]
    if: |
      always() && !cancelled() && 
      !contains(needs.*.result, 'failure') &&
      (needs.detect-changes.outputs.has_app_changes == 'true') &&
      (needs.wait-for-backend.result == 'success' || needs.wait-for-backend.result == 'skipped') &&
      (needs.wait-for-frontend.result == 'success' || needs.wait-for-frontend.result == 'skipped')
    permissions:
      contents: read
      packages: read
    
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Connect to Tailscale
        uses: tailscale/github-action@v4
        with:
          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENTID }}
          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
          tags: tag:ci
          hostname: banktracker-ci-${{ github.run_id }}

      - name: Configure SSH target
        id: ssh
        run: |
          TARGET="${{ secrets.TAILSCALE_SSH_TARGET }}"
          if [[ -z "$TARGET" ]]; then
            echo "::error::TAILSCALE_SSH_TARGET secret is not set"
            exit 1
          fi
          echo "target=$TARGET" >> "$GITHUB_OUTPUT"

      - name: Test connectivity
        run: |
          tailscale ssh "${{ steps.ssh.outputs.target }}" "echo 'Connected'"

      - name: Log in to GitHub Container Registry
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | tailscale ssh "${{ steps.ssh.outputs.target }}" \
            "docker login ghcr.io -u ${{ github.actor }} --password-stdin"

      - name: Clean up old Docker images
        run: |
          tailscale ssh "${{ steps.ssh.outputs.target }}" \
            "docker system prune -af --filter 'until=24h'"

      - name: Pull latest images
        run: |
          tailscale ssh "${{ steps.ssh.outputs.target }}" \
            "cd $DEPLOY_DIR && docker compose pull"

      - name: Deploy all services
        run: |
          tailscale ssh "${{ steps.ssh.outputs.target }}" \
            "cd $DEPLOY_DIR && docker compose down && docker compose up -d --wait"

      - name: Verify deployment
        if: success()
        run: |
          tailscale ssh "${{ steps.ssh.outputs.target }}" "cd $DEPLOY_DIR && docker compose ps"