deploy.yml

# ─────────────────────────────────────────────────────────────────────────────
# Deploy Workflow — VPS & AWS
# ─────────────────────────────────────────────────────────────────────────────
#
# PURPOSE
# ────────
# Builds Docker images, pushes them to GitHub Container Registry (GHCR), then
# deploys to the chosen environment via SSH (VPS) or ECS (AWS).
#
# This workflow is designed for:
#   - Any Linux VPS with Docker installed (Hostinger, Hetzner, DigitalOcean, etc.)
#   - AWS EC2 instances running Docker Compose
#   - AWS ECS/Fargate (see the commented AWS ECS jobs at the bottom)
#
# NOT needed for:
#   - Railway     → uses its own native Git-push deploy pipeline
#   - Render      → uses its own native deploy hooks
#   - Fly.io      → uses `flyctl deploy` (add a separate fly.yml if needed)
#
# ── TRIGGER ────────────────────────────────────────────────────────────────────
# Auto-deploy on push is intentionally DISABLED.
# This workflow is triggered manually (workflow_dispatch) only.
#
# To enable auto-deploy on push, uncomment the `push` block below:
# on:
#   push:
#     branches:
#       - main      # → triggers production deploy
#       - staging   # → triggers staging deploy
# ─────────────────────────────────────────────────────────────────────────────

name: Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        type: choice
        default: staging
        options:
          - staging
          - production

# ─────────────────────────────────────────────────────────────────────────────
# REQUIRED GITHUB SECRETS
# ─────────────────────────────────────────────────────────────────────────────
# Set these in: GitHub repo → Settings → Secrets and variables → Actions
#
# ── Registry (GHCR) ──────────────────────────────────────────────────────────
# GHCR_TOKEN         GitHub Personal Access Token with write:packages scope
#                    (or use ${{ secrets.GITHUB_TOKEN }} — no setup needed)
#
# ── Staging ──────────────────────────────────────────────────────────────────
# STAGING_SSH_HOST         IP address or hostname of the staging server
# STAGING_SSH_USER         SSH login user (e.g. ubuntu, root, deploy)
# STAGING_SSH_KEY          Private SSH key — full PEM content including headers
# STAGING_APP_DIR          App directory on server (e.g. /opt/app or /home/deploy/app)
# STAGING_VITE_APP_URL     API URL baked into the frontend build (e.g. https://staging-api.yourdomain.com/)
#                          Must end with a trailing slash.
#
# ── Production ───────────────────────────────────────────────────────────────
# PROD_SSH_HOST            IP address or hostname of the production server
# PROD_SSH_USER            SSH login user
# PROD_SSH_KEY             Private SSH key — full PEM content including headers
# PROD_APP_DIR             App directory on server (e.g. /opt/app)
# PROD_VITE_APP_URL        API URL baked into the frontend build (e.g. https://api.yourdomain.com/)
#                          Must end with a trailing slash.
#
# ── Optional: AWS ECS (only if using the ECS jobs below) ─────────────────────
# AWS_ACCESS_KEY_ID
# AWS_SECRET_ACCESS_KEY
# AWS_REGION                              e.g. us-east-1
# STAGING_ECR_BACKEND_URI                 e.g. 123456789.dkr.ecr.us-east-1.amazonaws.com/app-backend
# STAGING_ECR_FRONTEND_URI
# STAGING_ECS_CLUSTER                     ECS cluster name
# STAGING_ECS_SERVICE_BACKEND             ECS service name for backend
# STAGING_ECS_SERVICE_FRONTEND            ECS service name for frontend
# PROD_ECR_BACKEND_URI
# PROD_ECR_FRONTEND_URI
# PROD_ECS_CLUSTER
# PROD_ECS_SERVICE_BACKEND
# PROD_ECS_SERVICE_FRONTEND
# ─────────────────────────────────────────────────────────────────────────────

env:
  REGISTRY: ghcr.io
  BACKEND_IMAGE: ghcr.io/${{ github.repository_owner }}/app-backend
  FRONTEND_STAGING_IMAGE: ghcr.io/${{ github.repository_owner }}/app-frontend-staging
  FRONTEND_PRODUCTION_IMAGE: ghcr.io/${{ github.repository_owner }}/app-frontend-production

jobs:
  # ─────────────────────────────────────────────────────────────────────────
  # JOB 1 — Build and push all images
  # Builds once per commit SHA. Both staging and production deploy from these.
  # ─────────────────────────────────────────────────────────────────────────
  build:
    name: Build & Push Images
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          # Use GHCR_TOKEN secret for a fine-grained PAT, or
          # use GITHUB_TOKEN (auto-provided, no setup needed):
          password: ${{ secrets.GITHUB_TOKEN }}

      # ── Backend (one image shared across all environments) ──────────────────
      - name: Build and push backend
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.backend
          push: true
          tags: |
            ${{ env.BACKEND_IMAGE }}:${{ github.sha }}
            ${{ env.BACKEND_IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # ── Frontend — Staging (VITE_APP_URL baked in at build time) ───────────
      - name: Build and push frontend (staging)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.frontend
          push: true
          build-args: |
            VITE_APP_URL=${{ secrets.STAGING_VITE_APP_URL }}
            VITE_APP_TITLE=${{ github.event.repository.name }}
          tags: |
            ${{ env.FRONTEND_STAGING_IMAGE }}:${{ github.sha }}
            ${{ env.FRONTEND_STAGING_IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # ── Frontend — Production (separate image, different VITE_APP_URL) ──────
      - name: Build and push frontend (production)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile.frontend
          push: true
          build-args: |
            VITE_APP_URL=${{ secrets.PROD_VITE_APP_URL }}
            VITE_APP_TITLE=${{ github.event.repository.name }}
          tags: |
            ${{ env.FRONTEND_PRODUCTION_IMAGE }}:${{ github.sha }}
            ${{ env.FRONTEND_PRODUCTION_IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ─────────────────────────────────────────────────────────────────────────
  # JOB 2 — Deploy to Staging (VPS via SSH)
  # ─────────────────────────────────────────────────────────────────────────
  deploy-staging-vps:
    name: Deploy → Staging (VPS)
    needs: build
    runs-on: ubuntu-latest
    environment: staging   # GitHub Environment — add protection rules in repo Settings
    if: github.event.inputs.environment == 'staging'

    steps:
      - name: Deploy to staging VPS
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.STAGING_SSH_HOST }}
          username: ${{ secrets.STAGING_SSH_USER }}
          key: ${{ secrets.STAGING_SSH_KEY }}
          envs: BACKEND_IMAGE,FRONTEND_STAGING_IMAGE,SHA
          script: |
            set -e
            cd ${{ secrets.STAGING_APP_DIR }}

            # Pull the new images
            docker pull ${{ env.BACKEND_IMAGE }}:${{ github.sha }}
            docker pull ${{ env.FRONTEND_STAGING_IMAGE }}:${{ github.sha }}

            # Update the running containers (no rebuild — uses pulled images)
            BACKEND_IMAGE=${{ env.BACKEND_IMAGE }}:${{ github.sha }} \
            FRONTEND_IMAGE=${{ env.FRONTEND_STAGING_IMAGE }}:${{ github.sha }} \
            docker compose up -d --no-build

            # Remove dangling images to free disk space
            docker image prune -f

  # ─────────────────────────────────────────────────────────────────────────
  # JOB 3 — Deploy to Production (VPS via SSH)
  # Requires manual approval via GitHub Environment protection rules.
  # Set up in: repo Settings → Environments → production → Required reviewers
  # ─────────────────────────────────────────────────────────────────────────
  deploy-production-vps:
    name: Deploy → Production (VPS)
    needs: build
    runs-on: ubuntu-latest
    environment: production   # Configure required reviewers in GitHub repo settings
    if: github.event.inputs.environment == 'production'

    steps:
      - name: Deploy to production VPS
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_SSH_HOST }}
          username: ${{ secrets.PROD_SSH_USER }}
          key: ${{ secrets.PROD_SSH_KEY }}
          script: |
            set -e
            cd ${{ secrets.PROD_APP_DIR }}

            # Pull the new images
            docker pull ${{ env.BACKEND_IMAGE }}:${{ github.sha }}
            docker pull ${{ env.FRONTEND_PRODUCTION_IMAGE }}:${{ github.sha }}

            # Update the running containers (no rebuild — uses pulled images)
            BACKEND_IMAGE=${{ env.BACKEND_IMAGE }}:${{ github.sha }} \
            FRONTEND_IMAGE=${{ env.FRONTEND_PRODUCTION_IMAGE }}:${{ github.sha }} \
            docker compose up -d --no-build

            # Remove dangling images to free disk space
            docker image prune -f

# ─────────────────────────────────────────────────────────────────────────────
# AWS ECS ALTERNATIVE
# ─────────────────────────────────────────────────────────────────────────────
# Replace the VPS jobs above with these ECS jobs if you are deploying to AWS ECS.
# Also change the BACKEND_IMAGE / FRONTEND_*_IMAGE env vars at the top to ECR URIs.
#
# Prerequisites:
#   1. Create ECR repositories for backend and frontend (staging + production)
#   2. Create ECS clusters + task definitions + services
#   3. Add the AWS secrets listed in the secrets section above
#   4. Change REGISTRY above to: <account-id>.dkr.ecr.<region>.amazonaws.com
#
# ─────────────────────────────────────────────────────────────────────────────
#
#  deploy-staging-ecs:
#    name: Deploy → Staging (ECS)
#    needs: build
#    runs-on: ubuntu-latest
#    environment: staging
#    if: github.event.inputs.environment == 'staging'
#
#    steps:
#      - name: Configure AWS credentials
#        uses: aws-actions/configure-aws-credentials@v4
#        with:
#          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
#          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
#          aws-region: ${{ secrets.AWS_REGION }}
#
#      - name: Log in to Amazon ECR
#        uses: aws-actions/amazon-ecr-login@v2
#
#      # Re-tag and push to ECR (the build job pushed to GHCR — repush to ECR)
#      # Alternatively, change REGISTRY and IMAGE vars above to ECR URIs from the start.
#      - name: Force new ECS deployment (backend)
#        run: |
#          aws ecs update-service \
#            --cluster ${{ secrets.STAGING_ECS_CLUSTER }} \
#            --service ${{ secrets.STAGING_ECS_SERVICE_BACKEND }} \
#            --force-new-deployment \
#            --region ${{ secrets.AWS_REGION }}
#
#      - name: Force new ECS deployment (frontend)
#        run: |
#          aws ecs update-service \
#            --cluster ${{ secrets.STAGING_ECS_CLUSTER }} \
#            --service ${{ secrets.STAGING_ECS_SERVICE_FRONTEND }} \
#            --force-new-deployment \
#            --region ${{ secrets.AWS_REGION }}
#
#      - name: Wait for ECS service stability
#        run: |
#          aws ecs wait services-stable \
#            --cluster ${{ secrets.STAGING_ECS_CLUSTER }} \
#            --services ${{ secrets.STAGING_ECS_SERVICE_BACKEND }} ${{ secrets.STAGING_ECS_SERVICE_FRONTEND }} \
#            --region ${{ secrets.AWS_REGION }}
#
#  deploy-production-ecs:
#    name: Deploy → Production (ECS)
#    needs: build
#    runs-on: ubuntu-latest
#    environment: production
#    if: github.event.inputs.environment == 'production'
#
#    steps:
#      - name: Configure AWS credentials
#        uses: aws-actions/configure-aws-credentials@v4
#        with:
#          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
#          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
#          aws-region: ${{ secrets.AWS_REGION }}
#
#      - name: Log in to Amazon ECR
#        uses: aws-actions/amazon-ecr-login@v2
#
#      - name: Force new ECS deployment (backend)
#        run: |
#          aws ecs update-service \
#            --cluster ${{ secrets.PROD_ECS_CLUSTER }} \
#            --service ${{ secrets.PROD_ECS_SERVICE_BACKEND }} \
#            --force-new-deployment \
#            --region ${{ secrets.AWS_REGION }}
#
#      - name: Force new ECS deployment (frontend)
#        run: |
#          aws ecs update-service \
#            --cluster ${{ secrets.PROD_ECS_CLUSTER }} \
#            --service ${{ secrets.PROD_ECS_SERVICE_FRONTEND }} \
#            --force-new-deployment \
#            --region ${{ secrets.AWS_REGION }}
#
#      - name: Wait for ECS service stability
#        run: |
#          aws ecs wait services-stable \
#            --cluster ${{ secrets.PROD_ECS_CLUSTER }} \
#            --services ${{ secrets.PROD_ECS_SERVICE_BACKEND }} ${{ secrets.PROD_ECS_SERVICE_FRONTEND }} \
#            --region ${{ secrets.AWS_REGION }}