ci-cd.yml

name: CI/CD — Backend (Build → Push → Deploy)

on:
  push:
    branches: [ dev, staging ]
  pull_request:
    branches: [ dev, staging ]
  workflow_dispatch:
    inputs:
      tag:
        description: "배포할 이미지 태그 (ex. dev or dev-SHORT_SHA)"
        required: false
        default: "dev"

concurrency:
  group: cicd-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      IMAGE: ghcr.io/prgrms-web-devcourse-final-project/docsa-backend
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Cache Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Detect project dir
        id: detect
        shell: bash
        run: |
          if [ -f "./gradlew" ] || [ -f "./build.gradle" ] || [ -f "./build.gradle.kts" ]; then
            echo "dir=." >> $GITHUB_OUTPUT
          elif [ -d "./backend" ]; then
            echo "dir=backend" >> $GITHUB_OUTPUT
          else
            echo "No Gradle project found"; exit 1
          fi

      - name: Test
        env:
          MAIL_PASSWORD: ${{ secrets.CI_MAIL_PASSWORD }}
          MAIL_USERNAME: ${{ secrets.CI_MAIL_USERNAME }}
          MONGO_URI: ${{ secrets.CI_MONGO_URI }}
        run: |
          cd "${{ steps.detect.outputs.dir }}"
          chmod +x ./gradlew || true
          ./gradlew clean test --no-daemon

      - name: Find Dockerfile
        id: df
        run: |
          if [ -f "infra/backend/Dockerfile" ]; then
            echo "path=infra/backend/Dockerfile" >> $GITHUB_OUTPUT
            echo "ctx=." >> $GITHUB_OUTPUT
          else
            echo "No Dockerfile found"; exit 1
          fi

      - name: Build image (PR only)
        if: github.event_name == 'pull_request'
        run:  |
          docker build -f "${{ steps.df.outputs.path }}" -t sanity-check:pr "${{ steps.df.outputs.ctx }}"

      - name: Log in to GHCR
        if: github.event_name == 'push'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Decide tags by branch
        if: github.event_name == 'push'
        id: tags
        shell: bash
        run: |
          REF="${{ github.ref_name }}"               # dev / staging
          SHORT_SHA="${GITHUB_SHA::7}"
          SAFE_REF=$(echo "$REF" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9._-]+#-#g')
          echo "channel=$SAFE_REF" >> $GITHUB_OUTPUT          # ex) dev, staging
          echo "version=${SAFE_REF}-${SHORT_SHA}" >> $GITHUB_OUTPUT  # ex) dev-abc1234

      - name: Build & Push (branch-tagged)
        if: github.event_name == 'push'
        run: |
          CHAN=${{ steps.tags.outputs.channel }}   # dev | staging
          VER=${{ steps.tags.outputs.version }}    # dev-<sha> | staging-<sha>
          docker build -f "${{ steps.df.outputs.path }}" \
            -t $IMAGE:$CHAN \
            -t $IMAGE:$VER \
            "${{ steps.df.outputs.ctx }}"
          docker push $IMAGE:$CHAN
          docker push $IMAGE:$VER

  deploy:
    needs: build-and-push
    if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/staging') &&
      (needs.build-and-push.result == 'success')
      || (github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest

    steps:
      - name: Decide tag
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.tag }}" ]; then
            echo "value=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
          else
            echo "value=${{ github.ref_name }}" >> $GITHUB_OUTPUT
          fi

      - name: Deploy
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.CD_HOST }}
          username: ${{ secrets.CD_USER }}
          key: ${{ secrets.CD_SSH_KEY }}
          port: ${{ secrets.CD_PORT }}
          script: |
            if [ "${{ github.ref_name }}" = "staging" ]; then
              export DEPLOY_TAG='${{ steps.tag.outputs.value }}'
              bash -lc '/srv/docsa/infra/deploy.sh staging'
            else
              export DEPLOY_TAG='${{ steps.tag.outputs.value }}'
              bash -lc '/srv/docsa/infra/deploy.sh dev'
            fi