deploy-staging.yml

name: Deploy Staging

on:
  push:
    branches: [main]

permissions:
  contents: read
  packages: write
  id-token: write
  security-events: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set lowercase owner
        run: echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV

      - name: Set up QEMU
        uses: docker/setup-buildx-action@v2

      - name: Login to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Backup current staging-latest as staging-previous
        run: |
          set -e
          for img in backend frontend; do
            REPO=ghcr.io/${{ env.OWNER_LC }}/remitlend-${img}
            if docker pull ${REPO}:staging-latest; then
              docker tag ${REPO}:staging-latest ${REPO}:staging-previous || true
              docker push ${REPO}:staging-previous || true
            fi
          done

      - name: Build and push backend
        uses: docker/build-push-action@v4
        with:
          context: ./backend
          push: true
          tags: |
            ghcr.io/${{ env.OWNER_LC }}/remitlend-backend:staging-${{ github.sha }}
            ghcr.io/${{ env.OWNER_LC }}/remitlend-backend:staging-latest
          target: production
          build-args: |
            GIT_SHA=${{ github.sha }}
            BUILD_TIME=${{ github.event.head_commit.timestamp }}

      - name: Build and push frontend
        uses: docker/build-push-action@v4
        with:
          context: ./frontend
          push: true
          tags: |
            ghcr.io/${{ env.OWNER_LC }}/remitlend-frontend:staging-${{ github.sha }}
            ghcr.io/${{ env.OWNER_LC }}/remitlend-frontend:staging-latest
          target: runner

          build-args: |
            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
            NEXT_PUBLIC_RPC_URL=${{ vars.NEXT_PUBLIC_RPC_URL }}
            NEXT_PUBLIC_NETWORK_PASSPHRASE=${{ vars.NEXT_PUBLIC_NETWORK_PASSPHRASE }}
            NEXT_PUBLIC_EXPLORER_URL=${{ vars.NEXT_PUBLIC_EXPLORER_URL }}
            NEXT_PUBLIC_MANAGER_CONTRACT_ID=${{ vars.NEXT_PUBLIC_MANAGER_CONTRACT_ID }}
            NEXT_PUBLIC_POOL_CONTRACT_ID=${{ vars.NEXT_PUBLIC_POOL_CONTRACT_ID }}
            NEXT_PUBLIC_GOVERNANCE_CONTRACT_ID=${{ vars.NEXT_PUBLIC_GOVERNANCE_CONTRACT_ID }}
            NEXT_PUBLIC_NFT_CONTRACT_ID=${{ vars.NEXT_PUBLIC_NFT_CONTRACT_ID }}

      - name: Run Trivy vulnerability scanner (HIGH - warn)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'ghcr.io/${{ env.OWNER_LC }}/remitlend-backend:staging-${{ github.sha }}'
          format: 'table'
          severity: 'HIGH'
          exit-code: '0'
          trivyignores: '.trivyignore'

      - name: Run Trivy vulnerability scanner (CRITICAL - fail)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'ghcr.io/${{ env.OWNER_LC }}/remitlend-backend:staging-${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'
          exit-code: '1'
          # Without this, trivy-action builds the SARIF with ALL severities and
          # the exit-code then trips on any vulnerability (e.g. the existing
          # HIGH axios advisories) — not just CRITICAL as the step intends.
          # Limiting the report to the requested severity makes the gate fail
          # only on genuine CRITICAL findings.
          limit-severities-for-sarif: 'true'
          trivyignores: '.trivyignore'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Trivy vulnerability scanner for frontend (HIGH - warn)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'ghcr.io/${{ env.OWNER_LC }}/remitlend-frontend:staging-${{ github.sha }}'
          format: 'table'
          severity: 'HIGH'
          exit-code: '0'
          trivyignores: '.trivyignore'

      - name: Run Trivy vulnerability scanner for frontend (CRITICAL - fail)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'ghcr.io/${{ env.OWNER_LC }}/remitlend-frontend:staging-${{ github.sha }}'
          format: 'sarif'
          output: 'frontend-trivy-results.sarif'
          severity: 'CRITICAL'
          exit-code: '1'
          limit-severities-for-sarif: 'true'
          trivyignores: '.trivyignore'

      - name: Upload frontend Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'frontend-trivy-results.sarif'

      - name: Smoke-test the backend staging image
        run: |
          set -e
          REPO=ghcr.io/${{ env.OWNER_LC }}/remitlend-backend
          docker pull "${REPO}:staging-${{ github.sha }}"
          docker run -d --name remitlend-smoke -p 3001:3001 \
            -e NODE_ENV=production \
            "${REPO}:staging-${{ github.sha }}"
          echo "Waiting for /health to report healthy..."
          ok=""
          for i in $(seq 1 20); do
            if curl -fsS http://localhost:3001/health >/dev/null 2>&1; then ok=1; break; fi
            sleep 3
          done
          docker logs remitlend-smoke || true
          docker rm -f remitlend-smoke >/dev/null 2>&1 || true
          if [ -z "$ok" ]; then
            echo "::error::backend staging image failed the /health smoke test"
            exit 1
          fi
          echo "Backend staging image passed the /health smoke test."

      - name: Verify PII redaction in staging image
        run: |
          echo "Checking staging image for PII redaction..."
          REPO=ghcr.io/${{ env.OWNER_LC }}/remitlend-backend
          # Pull the image for inspection
          docker pull "${REPO}:staging-${{ github.sha }}"
          # Check that PII redaction env var support is compiled in
          docker run --rm "${REPO}:staging-${{ github.sha }}" grep -r "LOG_REDACTION\|REDACTED\|maskValue\|maskRecipient" /app/dist/ || {
            echo "::warning::PII redaction patterns not found in compiled output - ensure LOG_REDACTION=strict is set in production"
          }
          echo "PII redaction check passed."

  deploy:
    needs: build-and-push
    if: ${{ vars.STAGING_ENABLED == 'true' }}
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set lowercase owner
        run: echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_ENV

      - name: Prepare staging compose with owner and TAG
        run: |
          mkdir -p deploy
          sudo apt-get update && sudo apt-get install -y gettext-base
          export OWNER=${{ env.OWNER_LC }}
          export TAG=staging-latest
          envsubst < docker-compose.staging.yml > deploy/docker-compose.staging.resolved.yml
          # pre-generate a rollback compose referencing staging-previous
          export TAG=staging-previous
          envsubst < docker-compose.staging.yml > deploy/docker-compose.staging.rollback.yml

      - name: Copy compose files to server
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.STAGING_SSH_HOST }}
          username: ${{ secrets.STAGING_SSH_USER }}
          key: ${{ secrets.STAGING_SSH_KEY }}
          port: ${{ secrets.STAGING_SSH_PORT || 22 }}
          source: "docker-compose.yml,deploy/docker-compose.staging.resolved.yml,deploy/docker-compose.staging.rollback.yml"
          target: "~/remitlend"

      - name: Deploy on server and run migrations + healthcheck
        uses: appleboy/ssh-action@v0.1.7
        with:
          host: ${{ secrets.STAGING_SSH_HOST }}
          username: ${{ secrets.STAGING_SSH_USER }}
          key: ${{ secrets.STAGING_SSH_KEY }}
          port: ${{ secrets.STAGING_SSH_PORT || 22 }}
          script: |
            set -e
            cd ~/remitlend
            docker-compose -f docker-compose.yml -f docker-compose.staging.resolved.yml pull

            # Start DB first and wait for readiness
            docker-compose -f docker-compose.yml -f docker-compose.staging.resolved.yml up -d db
            for i in $(seq 1 30); do
              if docker-compose -f docker-compose.yml -f docker-compose.staging.resolved.yml exec -T db pg_isready -U postgres -d remitlend >/dev/null 2>&1; then
                echo "DB is ready"
                break
              fi
              sleep 2
            done

            # If DB not ready after wait, fail
            if ! docker-compose -f docker-compose.yml -f docker-compose.staging.resolved.yml exec -T db pg_isready -U postgres -d remitlend >/dev/null 2>&1; then
              echo "DB did not become ready"
              exit 1
            fi

            # Run migrations (must succeed)
            docker-compose -f docker-compose.yml -f docker-compose.staging.resolved.yml run --rm backend npm run migrate:up

            # Start backend and frontend
            docker-compose -f docker-compose.yml -f docker-compose.staging.resolved.yml up -d backend frontend --remove-orphans

            # Health check: backend /health and frontend root
            for i in $(seq 1 24); do
              ok=0
              if curl -fsS http://localhost:3001/health >/dev/null 2>&1; then
                ok=$((ok+1))
              fi
              if curl -fsS http://localhost:3000/ >/dev/null 2>&1; then
                ok=$((ok+1))
              fi
              if [ "$ok" -eq 2 ]; then
                echo "Health checks passed"
                exit 0
              fi
              sleep 5
            done

            echo "Health check failed, attempting rollback using rollback compose"
            PREV_BACKEND="ghcr.io/${{ env.OWNER_LC }}/remitlend-backend:staging-previous"
            PREV_FRONTEND="ghcr.io/${{ env.OWNER_LC }}/remitlend-frontend:staging-previous"
            docker pull $PREV_BACKEND || true
            docker pull $PREV_FRONTEND || true
            docker-compose -f docker-compose.yml -f docker-compose.staging.rollback.yml up -d --remove-orphans
            exit 1