cd-dev.yml

name: CD Dev (Azure)

on:
  workflow_run:
    workflows: ["CI"]
    branches: [develop]
    types: [completed]
  workflow_dispatch:
    inputs:
      tree_sha:
        description: >-
          Tree SHA to deploy (7-char, e.g. from a prior CD run's summary or an
          ACR tag). Leave empty to deploy current develop HEAD — same as the
          automatic path. Use this to roll back to a known-good release.
        required: false
        type: string

permissions:
  contents: read
  packages: read

env:
  AZURE_RG: api-observatory-rg
  VM_NAME: api-observatory-vm
  VM_USER: azureuser
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  environment-approval:
    name: "Require dev environment approval"
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    environment: dev
    concurrency:
      group: cd-dev-${{ github.run_id }}-approval
      cancel-in-progress: false
    steps:
      - name: Approval gate
        shell: bash
        run: |
          set -euo pipefail
          echo "Dev environment approval required before Azure VM deployment."

  resolve-images:
    name: "Resolve ACR image refs"
    runs-on: ubuntu-latest
    needs: [environment-approval]
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    outputs:
      ingestor: ${{ steps.images.outputs.ingestor }}
      dashboard: ${{ steps.images.outputs.dashboard }}
      tree_sha: ${{ steps.images.outputs.tree_sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Resolve tree SHA
        id: resolve
        if: ${{ inputs.tree_sha == '' || inputs.tree_sha == null }}
        uses: ./.github/actions/resolve-tree-sha

      - name: Resolve image refs
        id: images
        shell: bash
        run: |
          set -euo pipefail
          TREE_SHA="${{ inputs.tree_sha || steps.resolve.outputs.tree_sha }}"
          INGESTOR="${{ vars.ACR_LOGIN_SERVER }}/api-observatory/ingestor:tree-${TREE_SHA}"
          DASHBOARD="${{ vars.ACR_LOGIN_SERVER }}/api-observatory/dashboard:tree-${TREE_SHA}"
          echo "tree_sha=${TREE_SHA}" >> "$GITHUB_OUTPUT"
          echo "ingestor=${INGESTOR}" >> "$GITHUB_OUTPUT"
          echo "dashboard=${DASHBOARD}" >> "$GITHUB_OUTPUT"
          echo "Ingestor: ${INGESTOR}"
          echo "Dashboard: ${DASHBOARD}"

  deploy-azure-vm:
    name: "Deploy to Azure VM (Docker Compose)"
    runs-on: ubuntu-latest
    needs: [resolve-images]
    concurrency:
      group: cd-dev-azure-deploy
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get VM public IP
        id: vm
        shell: bash
        run: |
          set -euo pipefail
          VM_IP=$(az vm show \
            --resource-group "${{ env.AZURE_RG }}" \
            --name "${{ env.VM_NAME }}" \
            --show-details \
            --query publicIps \
            -o tsv)
          echo "ip=${VM_IP}" >> "$GITHUB_OUTPUT"
          echo "VM IP: ${VM_IP}"

      - name: Install SSH key
        uses: shimataro/ssh-key-action@a279ebf03eaeb1f7a2f72f4b4c25e5c3a5c1a820 # v2.7.0
        with:
          key: ${{ secrets.AZURE_VM_SSH_KEY }}
          known_hosts: ${{ secrets.AZURE_VM_HOST_KEY }}
          if_key_exists: replace

      - name: Deploy via SSH
        env:
          VM_IP: ${{ steps.vm.outputs.ip }}
          INGESTOR_IMAGE: ${{ needs.resolve-images.outputs.ingestor }}
          DASHBOARD_IMAGE: ${{ needs.resolve-images.outputs.dashboard }}
          TREE_SHA: ${{ needs.resolve-images.outputs.tree_sha }}
          ACR_LOGIN_SERVER: ${{ vars.ACR_LOGIN_SERVER }}
          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
        shell: bash
        run: |
          set -euo pipefail
          echo "Deploying to ${VM_IP}..."
          echo "  Ingestor: ${INGESTOR_IMAGE}"
          echo "  Dashboard: ${DASHBOARD_IMAGE}"
          echo "  SERVICE_VERSION: tree-${TREE_SHA}"

          ssh "${{ env.VM_USER }}@${VM_IP}" bash -s <<DEPLOY_SCRIPT
          set -euo pipefail
          cd ~/app

          # Log in to ACR and pull latest images
          echo "Logging in to ACR..."
          echo "${ACR_PASSWORD}" | docker login "${ACR_LOGIN_SERVER}" -u "${ACR_USERNAME}" --password-stdin

          echo "Pulling images..."
          docker pull "${INGESTOR_IMAGE}"
          docker pull "${DASHBOARD_IMAGE}"

          # Tag as :latest for docker-compose
          docker tag "${INGESTOR_IMAGE}" api-observatory/ingestor:latest
          docker tag "${DASHBOARD_IMAGE}" api-observatory/dashboard:latest

          # Record the exact deployed version so the running container's
          # self-reported /version matches the image that was actually deployed.
          sed -i '/^SERVICE_VERSION=/d' .env
          echo "SERVICE_VERSION=tree-${TREE_SHA}" >> .env

          # Restart services
          echo "Restarting services..."
          docker compose down --timeout 30
          docker compose up -d

          # Wait for health
          echo "Waiting for health check..."
          for i in {1..30}; do
            if curl -sf http://localhost:8000/health > /dev/null 2>&1; then
              echo "Ingestor healthy"
              break
            fi
            sleep 2
          done
          curl -sf http://localhost:8000/health || { echo "Health check failed"; exit 1; }

          # Verify the running container reports the version that was actually
          # deployed — a deploy that "succeeds" but reports the wrong version
          # should fail CD, not silently ship.
          echo "Verifying deployed version..."
          DEPLOYED_VERSION=\$(curl -sf http://localhost:8000/version | python3 -c 'import json,sys; print(json.load(sys.stdin)["service"])')
          if [ "\${DEPLOYED_VERSION}" != "tree-${TREE_SHA}" ]; then
            echo "Version mismatch: expected tree-${TREE_SHA}, got \${DEPLOYED_VERSION}"
            exit 1
          fi
          echo "Version verified: \${DEPLOYED_VERSION}"

          # Prune old images
          docker image prune -f --filter "until=48h"
          echo "Deploy complete"
          DEPLOY_SCRIPT

  smoke-tests:
    name: "Smoke tests"
    runs-on: ubuntu-latest
    needs: [deploy-azure-vm, resolve-images]
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Get VM public IP
        id: vm
        shell: bash
        run: |
          set -euo pipefail
          VM_IP=$(az vm show \
            --resource-group "${{ env.AZURE_RG }}" \
            --name "${{ env.VM_NAME }}" \
            --show-details \
            --query publicIps \
            -o tsv)
          echo "ip=${VM_IP}" >> "$GITHUB_OUTPUT"

      - name: Run smoke tests
        env:
          VM_IP: ${{ steps.vm.outputs.ip }}
        shell: bash
        run: |
          set -euo pipefail
          INGESTOR_URL="http://${VM_IP}:8000"
          DASHBOARD_URL="http://${VM_IP}:8501"
          bash scripts/smoke-test.sh "${INGESTOR_URL}" "${DASHBOARD_URL}"

  publish-summary:
    name: "Publish CD summary"
    runs-on: ubuntu-latest
    needs: [environment-approval, resolve-images, deploy-azure-vm, smoke-tests]
    if: always()
    steps:
      - name: Publish summary
        shell: bash
        env:
          TRIGGER: ${{ github.event_name }}
          WORKFLOW_URL: ${{ github.event.workflow_run.html_url }}
          COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
          TREE_SHA: ${{ needs.resolve-images.outputs.tree_sha }}
          INGESTOR_IMG: ${{ needs.resolve-images.outputs.ingestor }}
          DASHBOARD_IMG: ${{ needs.resolve-images.outputs.dashboard }}
          DEPLOY_RESULT: ${{ needs.deploy-azure-vm.result }}
          SMOKE_RESULT: ${{ needs.smoke-tests.result }}
        run: |
          set -euo pipefail
          STATUS="deployed"
          if [ "${DEPLOY_RESULT}" != "success" ]; then
            STATUS="deploy failed"
          elif [ "${SMOKE_RESULT}" != "success" ]; then
            STATUS="smoke tests failed"
          fi
          {
            echo "## CD Dev (Azure)"
            if [ "${TRIGGER}" = "workflow_dispatch" ]; then
              echo "Triggered manually (rollback/redeploy) — tree_sha: ${TREE_SHA}"
            else
              echo "Triggered by CI run: ${WORKFLOW_URL}"
            fi
            echo "Commit: ${COMMIT_SHA}"
            echo "Deployed version: tree-${TREE_SHA}"
            echo "Ingestor: ${INGESTOR_IMG}"
            echo "Dashboard: ${DASHBOARD_IMG}"
            echo "Cloud: Azure VM (B1s free tier)"
            echo "Status: ${STATUS}"
          } >> "$GITHUB_STEP_SUMMARY"