deploy.yml

name: Deploy API and worker to Render

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Target Render environment
        required: true
        type: choice
        options:
          - staging
          - production
      run_smoke_tests:
        description: Run smoke tests after deploy
        required: true
        default: true
        type: boolean

concurrency:
  group: deploy-${{ inputs.environment }}
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Deploy to Render (${{ inputs.environment }})
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Set up Python 3.11
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"

      - name: Cache pip dependencies
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      # This must remain before either create step: invalid branch/environment
      # combinations and missing configuration must result in zero Render POSTs.
      - name: Validate deployment preflight
        env:
          DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
          RUN_SMOKE_TESTS: ${{ inputs.run_smoke_tests }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
          GITHUB_SHA: ${{ github.sha }}
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_STAGING_SERVICE_ID: ${{ secrets.RENDER_STAGING_SERVICE_ID }}
          RENDER_STAGING_WORKER_SERVICE_ID: ${{ secrets.RENDER_STAGING_WORKER_SERVICE_ID }}
          RENDER_PRODUCTION_SERVICE_ID: ${{ secrets.RENDER_PRODUCTION_SERVICE_ID }}
          RENDER_PRODUCTION_WORKER_SERVICE_ID: ${{ secrets.RENDER_PRODUCTION_WORKER_SERVICE_ID }}
          STAGING_API_URL: ${{ secrets.STAGING_API_URL }}
          PRODUCTION_API_URL: ${{ secrets.PRODUCTION_API_URL }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
        run: python scripts/render_deploy_preflight.py

      # The API must become live before a new worker is created. API startup
      # owns schema migration, and the worker for this SHA may require it.
      - name: Create API deployment
        id: create_api
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_SERVICE_ID: ${{ env.RENDER_API_SERVICE_ID }}
          RENDER_SERVICE_NAME: API
          GITHUB_SHA: ${{ github.sha }}
        run: python scripts/render_deploy.py create

      - name: Wait for API deployment
        id: wait_api
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_SERVICE_ID: ${{ env.RENDER_API_SERVICE_ID }}
          RENDER_SERVICE_NAME: API
          RENDER_DEPLOY_ID: ${{ steps.create_api.outputs.deploy_id }}
          GITHUB_SHA: ${{ github.sha }}
        run: python scripts/render_deploy.py wait

      - name: Create worker deployment
        id: create_worker
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_SERVICE_ID: ${{ env.RENDER_WORKER_SERVICE_ID }}
          RENDER_SERVICE_NAME: worker
          GITHUB_SHA: ${{ github.sha }}
        run: python scripts/render_deploy.py create

      - name: Wait for worker deployment
        id: wait_worker
        continue-on-error: true
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
          RENDER_SERVICE_ID: ${{ env.RENDER_WORKER_SERVICE_ID }}
          RENDER_SERVICE_NAME: worker
          RENDER_DEPLOY_ID: ${{ steps.create_worker.outputs.deploy_id }}
          GITHUB_SHA: ${{ github.sha }}
        run: python scripts/render_deploy.py wait

      - name: Require both deployments to be live
        if: always()
        env:
          API_RESULT: ${{ steps.wait_api.outcome }}
          WORKER_RESULT: ${{ steps.wait_worker.outcome }}
          API_DEPLOY_ID: ${{ steps.create_api.outputs.deploy_id }}
          WORKER_DEPLOY_ID: ${{ steps.create_worker.outputs.deploy_id }}
          GITHUB_SHA: ${{ github.sha }}
        run: |
          if [ "$API_RESULT" != "success" ] || [ "$WORKER_RESULT" != "success" ]; then
            echo "ERROR: coordinated deployment failed for SHA $GITHUB_SHA. API deploy $API_DEPLOY_ID: $API_RESULT; worker deploy $WORKER_DEPLOY_ID: $WORKER_RESULT."
            exit 1
          fi
          echo "API deploy $API_DEPLOY_ID and worker deploy $WORKER_DEPLOY_ID are live at SHA $GITHUB_SHA."

      - name: Health gate check
        env:
          DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
        run: |
          MAX_RETRIES=5
          RETRY_DELAY=15
          URL="${API_URL}/health"

          echo "Pinging health gate at: $URL"
          for i in $(seq 1 $MAX_RETRIES); do
            echo "Health check attempt $i of $MAX_RETRIES..."
            HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$URL" --max-time 30) || true
            if [ "$HTTP_STATUS" -eq 200 ]; then
              echo "Health check passed (HTTP $HTTP_STATUS)"
              exit 0
            fi
            echo "Got HTTP $HTTP_STATUS; retrying in ${RETRY_DELAY}s..."
            sleep $RETRY_DELAY
          done
          echo "ERROR: Health gate failed after $MAX_RETRIES attempts on $DEPLOY_ENVIRONMENT."
          exit 1

      - name: Run smoke tests against live deployment
        if: inputs.run_smoke_tests
        env:
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          RUN_REAL_SCAN: "true"
        run: |
          echo "Running smoke tests against: $API_URL"
          python tests/smoke_test.py