deploy.yml

name: Deploy z8run

on:
  # Automatic production deploys are DISABLED.
  # Re-enable by uncommenting the push trigger below.
  # push:
  #   branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-production
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_Z8RUN: ghcr.io/${{ github.repository }}-api
  IMAGE_NGINX: ghcr.io/${{ github.repository }}-nginx

jobs:
  build-and-push:
    name: Build & Push Images
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
    outputs:
      image_tag: ${{ github.sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build and push z8run API image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          push: true
          tags: |
            ${{ env.IMAGE_Z8RUN }}:latest
            ${{ env.IMAGE_Z8RUN }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false

      - name: Build and push nginx image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./deploy/Dockerfile.nginx
          platforms: linux/amd64
          push: true
          tags: |
            ${{ env.IMAGE_NGINX }}:latest
            ${{ env.IMAGE_NGINX }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false

  deploy:
    name: Deploy to Server
    needs: build-and-push
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    environment: production
    permissions:
      contents: read
    env:
      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
      DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
      DEPLOY_PATH: /opt/z8run
      IMAGE_TAG: ${{ needs.build-and-push.outputs.image_tag }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          sparse-checkout: |
            docker-compose.yml
            deploy/nginx.conf

      - name: Setup SSH key
        run: |
          install -m 600 -D /dev/null ~/.ssh/deploy_key
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          ssh-keyscan -H ${{ env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

      - name: Deploy on server
        env:
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Sync only compose + nginx config
          rsync -avz \
            -e "ssh -i ~/.ssh/deploy_key" \
            docker-compose.yml deploy/nginx.conf \
            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }}:${{ env.DEPLOY_PATH }}/

          ssh -i ~/.ssh/deploy_key ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} << 'DEPLOY_EOF'
            set -euo pipefail
            cd ${{ env.DEPLOY_PATH }}

            mkdir -p deploy
            mv nginx.conf deploy/nginx.conf 2>/dev/null || true

            # Login to GHCR
            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

            # Pull new images
            docker compose pull

            # Restart with new images
            docker compose up -d --remove-orphans

            # Clean up only z8run dangling images
            docker image prune -f --filter "label=org.opencontainers.image.source=https://github.com/${{ github.repository }}"

            echo "✓ z8run deployed successfully (tag: ${{ env.IMAGE_TAG }})"
          DEPLOY_EOF

      - name: Health check
        run: |
          for i in 1 2 3 4 5; do
            sleep 10
            if ssh -i ~/.ssh/deploy_key ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \
              "curl -sf http://localhost/api/v1/health > /dev/null"; then
              echo "✓ Health check passed (attempt $i)"
              exit 0
            fi
            echo "⏳ Attempt $i/5 failed, retrying..."
          done

          echo "✗ Health check failed after 5 attempts"
          ssh -i ~/.ssh/deploy_key ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \
            "docker compose -f ${{ env.DEPLOY_PATH }}/docker-compose.yml logs --tail=50"
          exit 1

      - name: Cleanup SSH key
        if: always()
        run: rm -f ~/.ssh/deploy_key