cd-deploy.yml

name: CD Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        type: choice
        options:
          - staging
          - production
      services:
        description: 'Services to deploy'
        required: true
        type: choice
        options:
          - all
          - backend
          - console
          - management
      skip_migrations:
        description: 'Skip database migrations'
        required: false
        type: boolean
        default: false
      image_tag:
        description: 'Image tag to deploy'
        required: false
        type: string
        default: 'latest'

concurrency:
  group: deploy-${{ github.event.inputs.environment }}
  cancel-in-progress: false

env:
  REGISTRY: ghcr.io
  IMAGE_TAG: ${{ github.event.inputs.image_tag || 'latest' }}

jobs:
  deploy:
    name: Deploy to ${{ github.event.inputs.environment }}
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Run database migrations
        if: ${{ !github.event.inputs.skip_migrations }}
        run: |
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
            ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} -p ${{ secrets.DEPLOY_PORT || 22 }} \
            "cd ${{ secrets.DEPLOY_PATH }} && \
             docker run --rm --network host \
               -e FLYWAY_URL='jdbc:mysql://${{ secrets.DB_HOST }}:${{ secrets.DB_PORT }}/${{ secrets.DB_NAME }}?allowPublicKeyRetrieval=true&useSSL=true' \
               -e FLYWAY_USER='${{ secrets.DB_USER }}' \
               -e FLYWAY_PASSWORD='${{ secrets.DB_PASSWORD }}' \
               -v \$(pwd)/init-db/migrations:/flyway/sql:ro \
               flyway/flyway:10.17.0 -connectRetries=10 migrate"

      - name: Pull and deploy services
        run: |
          SSH_CMD="ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} -p ${{ secrets.DEPLOY_PORT || 22 }}"

          # Login to GHCR on remote
          $SSH_CMD "echo ${{ secrets.GITHUB_TOKEN }} | docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin"

          # Pull and deploy with IMAGE_TAG exported in the same shell session
          $SSH_CMD "cd ${{ secrets.DEPLOY_PATH }} && \
                    export IMAGE_TAG=${{ github.event.inputs.image_tag || 'latest' }} && \
                    docker compose -f docker-compose.yml -f docker-compose.prod.yml pull && \
                    docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --remove-orphans"

      - name: Health check - backend (fail fast)
        run: |
          SSH_CMD="ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} -p ${{ secrets.DEPLOY_PORT || 22 }}"
          echo "Checking backend health..."
          for i in $(seq 1 15); do
            if $SSH_CMD "docker exec ulticode-backend curl -sf 'http://localhost:9001/contest?page=1&size=1' > /dev/null 2>&1"; then
              echo "  Backend is healthy"
              break
            fi
            if [ "$i" -eq 15 ]; then
              echo "::error::Backend failed health check after 75 seconds"
              exit 1
            fi
            echo "  Waiting for backend... ($i/15)"
            sleep 5
          done

      - name: Health check - frontends
        run: |
          SSH_CMD="ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} -p ${{ secrets.DEPLOY_PORT || 22 }}"
          SERVICES=("console:9002" "management:9003")
          for svc in "${SERVICES[@]}"; do
            NAME="${svc%%:*}"
            PORT="${svc#*:}"
            echo "Checking $NAME..."
            for i in $(seq 1 15); do
              if $SSH_CMD "curl -sf http://localhost:$PORT > /dev/null 2>&1"; then
                echo "  $NAME is healthy"
                break
              fi
              if [ "$i" -eq 15 ]; then
                echo "::error::$NAME failed health check after 75 seconds"
                exit 1
              fi
              echo "  Waiting for $NAME... ($i/15)"
              sleep 5
            done
          done

      - name: Notify failure
        if: failure()
        run: |
          echo "::error::Deployment to ${{ github.event.inputs.environment }} failed. Check logs for details."