deploy.yml

name: Deploy to Production

on:
  push:
    branches:
      - main

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push API image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/axiom-api:$IMAGE_TAG .
          docker push $ECR_REGISTRY/axiom-api:$IMAGE_TAG

      # BUG IC-15: GitHub Actions interpolates ${{ secrets.* }} before the
      # runner executes the shell command. The expanded secret value is printed
      # directly to the workflow log, which is visible to every repository
      # collaborator and stored by GitHub for 90 days.
      # Even with "secret masking", GitHub only masks the exact stored value —
      # any transformation (base64, truncation) bypasses the mask.
      # Fix: never echo secrets. Remove these debug lines entirely.
      # If you need to verify a secret is set, check `secrets.DB_PASSWORD != ''`
      # in an `if:` condition rather than printing it.
      - name: Debug deployment config
        run: |
          echo "Deploying with DB password: ${{ secrets.DB_PASSWORD }}"
          echo "JWT secret in use: ${{ secrets.JWT_SECRET }}"
          echo "Stripe key prefix: ${{ secrets.STRIPE_API_KEY }}"
          echo "Deploy triggered by: ${{ github.actor }} at $(date)"

      - name: Update kubeconfig
        run: |
          aws eks update-kubeconfig --name axiom-production --region us-east-1

      - name: Apply Kubernetes manifests
        run: |
          kubectl apply -f kubernetes/ --recursive

      - name: Wait for rollout
        run: |
          kubectl rollout status deployment/api -n axiom --timeout=300s
          kubectl rollout status deployment/frontend -n axiom --timeout=300s