deploy-application.yaml

name: Deploy Application

on:
  workflow_dispatch:
    inputs:
      application_id:
        required: true
        type: string
      name:
        required: true
        type: string
      image:
        required: true
        type: string
      port:
        required: true
        type: string
      host_port:
        required: true
        type: string
      attempt_id:
        required: true
        type: string
      resources:
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: application-${{ inputs.application_id }}
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy application to home VM
    runs-on: [self-hosted, linux, idp-vm]
    timeout-minutes: 20
    env:
      APPLICATION_ID: ${{ inputs.application_id }}
      APPLICATION_NAME: ${{ inputs.name }}
      APPLICATION_IMAGE: ${{ inputs.image }}
      CONTAINER_PORT: ${{ inputs.port }}
      HOST_PORT: ${{ inputs.host_port }}
      ATTEMPT_ID: ${{ inputs.attempt_id }}
      REQUESTED_RESOURCES: ${{ inputs.resources }}
      IDP_API_URL: ${{ vars.IDP_API_URL }}
      APPLICATION_BASE_URL: ${{ vars.APPLICATION_BASE_URL }}
      APPLICATION_BIND_ADDRESS: ${{ vars.APPLICATION_BIND_ADDRESS || '127.0.0.1' }}
      # Every container this workflow starts gets these limits, so one deployment
      # cannot starve the VM it shares with everything else.
      CONTAINER_MEMORY_LIMIT: ${{ vars.CONTAINER_MEMORY_LIMIT || '512m' }}
      CONTAINER_CPU_LIMIT: ${{ vars.CONTAINER_CPU_LIMIT || '1' }}
      CONTAINER_PIDS_LIMIT: ${{ vars.CONTAINER_PIDS_LIMIT || '512' }}
      CALLBACK_TOKEN: ${{ secrets.DEPLOYMENT_CALLBACK_TOKEN }}
    steps:
      - name: Validate deployment request
        run: |
          [[ "$APPLICATION_ID" =~ ^[0-9]+$ ]]
          [[ "$APPLICATION_NAME" =~ ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ ]]
          [[ "$APPLICATION_IMAGE" =~ ^[A-Za-z0-9./:@_-]+$ ]]
          [[ "$CONTAINER_PORT" =~ ^[0-9]+$ ]]
          (( CONTAINER_PORT >= 1 && CONTAINER_PORT <= 65535 ))
          [[ "$HOST_PORT" =~ ^[0-9]+$ ]]
          (( HOST_PORT >= 10000 && HOST_PORT <= 65535 ))
          [[ "$ATTEMPT_ID" =~ ^[a-f0-9]{32}$ ]]
          [[ "$APPLICATION_BIND_ADDRESS" =~ ^[0-9.]+$ ]]
          [[ "$CONTAINER_MEMORY_LIMIT" =~ ^[0-9]+[mg]$ ]]
          [[ "$CONTAINER_CPU_LIMIT" =~ ^[0-9]+(\.[0-9]+)?$ ]]
          [[ "$CONTAINER_PIDS_LIMIT" =~ ^[0-9]+$ ]]
          (( CONTAINER_PIDS_LIMIT >= 32 ))
          test -n "$IDP_API_URL"
          test -n "$CALLBACK_TOKEN"

      - name: Report deployment started
        run: |
          curl --fail --silent --show-error \
            -X POST "$IDP_API_URL/applications/$APPLICATION_ID/deployment-callback" \
            -H "Content-Type: application/json" \
            -H "X-Deployment-Token: $CALLBACK_TOKEN" \
            -d "{\"status\":\"deploying\",\"attempt_id\":\"$ATTEMPT_ID\"}"

      - name: Prepare destination and resources
        run: |
          docker network inspect idp-apps >/dev/null 2>&1 || docker network create idp-apps
          secret_dir="$HOME/.idp/applications/$APPLICATION_ID"
          mkdir -p "$secret_dir"
          chmod 700 "$HOME/.idp" "$HOME/.idp/applications" "$secret_dir"
          touch "$secret_dir/app.env"
          chmod 600 "$secret_dir/app.env"

          if [[ ",$REQUESTED_RESOURCES," == *",postgresql,"* ]]; then
            if [ ! -s "$secret_dir/postgres.env" ]; then
              password=$(openssl rand -hex 24)
              {
                printf 'POSTGRES_USER=idp_app\n'
                printf 'POSTGRES_DB=app\n'
                printf 'POSTGRES_PASSWORD=%s\n' "$password"
              } > "$secret_dir/postgres.env"
              printf 'DATABASE_URL=postgresql://idp_app:%s@idp-db-%s:5432/app\n' \
                "$password" "$APPLICATION_ID" >> "$secret_dir/app.env"
              chmod 600 "$secret_dir/postgres.env" "$secret_dir/app.env"
            fi

            if ! docker container inspect "idp-db-$APPLICATION_ID" >/dev/null 2>&1; then
              docker run -d \
                --name "idp-db-$APPLICATION_ID" \
                --restart unless-stopped \
                --memory "$CONTAINER_MEMORY_LIMIT" \
                --cpus "$CONTAINER_CPU_LIMIT" \
                --pids-limit "$CONTAINER_PIDS_LIMIT" \
                --security-opt no-new-privileges \
                --network idp-apps \
                --env-file "$secret_dir/postgres.env" \
                --volume "idp-db-$APPLICATION_ID:/var/lib/postgresql/data" \
                postgres:16-alpine
            else
              docker start "idp-db-$APPLICATION_ID" >/dev/null
            fi

            for attempt in {1..30}; do
              if docker exec "idp-db-$APPLICATION_ID" pg_isready -U idp_app -d app >/dev/null 2>&1; then
                break
              fi
              if [ "$attempt" -eq 30 ]; then
                echo "PostgreSQL did not become ready"
                exit 1
              fi
              sleep 2
            done
          fi

      - name: Deploy container with rollback
        run: |
          container_name="idp-app-$APPLICATION_ID-$APPLICATION_NAME"
          secret_file="$HOME/.idp/applications/$APPLICATION_ID/app.env"
          previous_image=$(docker inspect --format '{{.Config.Image}}' "$container_name" 2>/dev/null || true)
          docker pull "$APPLICATION_IMAGE"
          docker stop "$container_name" >/dev/null 2>&1 || true
          docker rm "$container_name" >/dev/null 2>&1 || true

          run_application() {
            image="$1"
            docker run -d \
              --name "$container_name" \
              --restart unless-stopped \
              --memory "$CONTAINER_MEMORY_LIMIT" \
              --cpus "$CONTAINER_CPU_LIMIT" \
              --pids-limit "$CONTAINER_PIDS_LIMIT" \
              --security-opt no-new-privileges \
              --network idp-apps \
              --env-file "$secret_file" \
              --label "idp.application-id=$APPLICATION_ID" \
              --label "idp.application-name=$APPLICATION_NAME" \
              -p "$APPLICATION_BIND_ADDRESS:$HOST_PORT:$CONTAINER_PORT" \
              "$image"
          }

          run_application "$APPLICATION_IMAGE"
          health_host="$APPLICATION_BIND_ADDRESS"
          if [ "$health_host" = "0.0.0.0" ]; then
            health_host="127.0.0.1"
          fi
          health_url="http://$health_host:$HOST_PORT/health"
          root_url="http://$health_host:$HOST_PORT/"
          for attempt in {1..20}; do
            if curl --fail --silent "$health_url" >/dev/null; then
              echo "$health_url" > "$RUNNER_TEMP/application-health-url"
              exit 0
            fi
            if curl --fail --silent "$root_url" >/dev/null; then
              echo "$root_url" > "$RUNNER_TEMP/application-health-url"
              exit 0
            fi
            sleep 2
          done

          docker logs --tail 100 "$container_name" > "$RUNNER_TEMP/application-failure.log" 2>&1 || true
          docker rm --force "$container_name" >/dev/null 2>&1 || true
          if [ -n "$previous_image" ]; then
            run_application "$previous_image"
          fi
          exit 1

      - name: Report deployment success
        run: |
          application_url=""
          health_url="$(cat "$RUNNER_TEMP/application-health-url" 2>/dev/null || true)"
          runtime_id="$(docker inspect --format '{{.Id}}' "idp-app-$APPLICATION_ID-$APPLICATION_NAME" 2>/dev/null || true)"
          logs="$(docker logs --tail 80 "idp-app-$APPLICATION_ID-$APPLICATION_NAME" 2>&1 | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()[-4000:]))')"
          if [ -n "$APPLICATION_BASE_URL" ]; then
            application_url="${APPLICATION_BASE_URL%/}:$HOST_PORT"
            if [ -n "$health_url" ]; then
              health_path="${health_url#http://127.0.0.1:$HOST_PORT}"
              health_path="${health_path#http://$APPLICATION_BIND_ADDRESS:$HOST_PORT}"
              health_url="$application_url$health_path"
            fi
          fi
          payload=$(printf '{"status":"running","attempt_id":"%s","url":"%s","health_url":"%s","runtime_id":"%s","logs":%s}' \
            "$ATTEMPT_ID" "$application_url" "$health_url" "$runtime_id" "$logs")
          curl --fail --silent --show-error \
            -X POST "$IDP_API_URL/applications/$APPLICATION_ID/deployment-callback" \
            -H "Content-Type: application/json" \
            -H "X-Deployment-Token: $CALLBACK_TOKEN" \
            -d "$payload"

      - name: Report deployment failure
        if: failure()
        run: |
          logs="$(cat "$RUNNER_TEMP/application-failure.log" 2>/dev/null | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()[-4000:]))')"
          payload=$(printf '{"status":"failed","attempt_id":"%s","error":"The VM deployment workflow failed. Review the GitHub Actions log.","logs":%s}' "$ATTEMPT_ID" "$logs")
          curl --fail --silent --show-error \
            -X POST "$IDP_API_URL/applications/$APPLICATION_ID/deployment-callback" \
            -H "Content-Type: application/json" \
            -H "X-Deployment-Token: $CALLBACK_TOKEN" \
            -d "$payload"