deploy.yml

name: Deploy to Production

on:
  push:
    branches: [master]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag to deploy (leave empty for latest)'
        required: false
        type: string
        default: ''

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: vreshch/diffractwd.com

jobs:
  build-and-push:
    name: 🐳 Build & Push Docker Image
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      image-tag: ${{ steps.set-tag.outputs.tag }}

    steps:
      - name: 📥 Checkout code
        uses: actions/checkout@v7

      - name: 🏷️ Determine image tag
        id: set-tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ inputs.tag }}" ]; then
            echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
            echo "📌 Using custom tag: ${{ inputs.tag }}"
          else
            echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
            echo "📌 Using commit SHA: ${{ github.sha }}"
          fi

      - name: 🔐 Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🐳 Build and push Docker image
        run: |
          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          TAG="${{ steps.set-tag.outputs.tag }}"

          echo "🏗️ Building image..."
          docker build \
            --build-arg COMMIT_SHA="${{ github.sha }}" \
            --build-arg BRANCH="${{ github.ref_name }}" \
            --build-arg BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            -t ${IMAGE}:${TAG} -t ${IMAGE}:latest .

          echo "📤 Pushing image..."
          docker push ${IMAGE}:${TAG}
          docker push ${IMAGE}:latest

          echo "✅ Image pushed successfully!"
          echo "📦 Image: ${IMAGE}:${TAG}"
          echo "📦 Image: ${IMAGE}:latest"

  deploy:
    name: 🚀 Deploy to Server
    needs: build-and-push
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: production

    steps:
      - name: 📥 Checkout code
        uses: actions/checkout@v7

      - name: 🔧 Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts

          # Test SSH connection
          echo "Testing SSH connection..."
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no root@${{ secrets.SERVER_HOST }} "echo 'SSH connection successful'"

      - name: 📤 Copy deployment files to server
        run: |
          echo "📦 Ensuring remote directory exists..."
          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} "mkdir -p /opt/diffractwd-com && chown root:root /opt/diffractwd-com && chmod 755 /opt/diffractwd-com"

          echo "📦 Copying docker-compose.yml..."
          scp -i ~/.ssh/deploy_key docker-compose.yml root@${{ secrets.SERVER_HOST }}:/opt/diffractwd-com/

          echo "📦 Copying deployment script..."
          scp -i ~/.ssh/deploy_key scripts/deploy.sh root@${{ secrets.SERVER_HOST }}:/opt/diffractwd-com/
          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} "chmod +x /opt/diffractwd-com/deploy.sh"

      - name: 🚀 Deploy application
        id: deploy
        run: |
          IMAGE_TAG="${{ needs.build-and-push.outputs.image-tag }}"

          echo "🚀 Deploying to production..."
          echo "📦 Image tag: ${IMAGE_TAG}"

          ssh -i ~/.ssh/deploy_key root@${{ secrets.SERVER_HOST }} << EOF
            set -e
            cd /opt/diffractwd-com
            
            # Authenticate with GHCR on server
            echo "🔐 Authenticating with GHCR..."
            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin

            # Update image tag in docker-compose
            sed -i "s|image:.*|image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}|g" docker-compose.yml

            # Pull new image before deploying
            echo "📥 Pulling image..."
            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}

            # Deploy to Docker Swarm
            echo "🐳 Deploying stack..."
            docker stack deploy -c docker-compose.yml diffractwd --with-registry-auth

            # Force service update to ensure containers restart with new image
            echo "🔄 Forcing service update..."
            docker service update --force diffractwd_web

            # Wait for deployment
            echo "⏳ Waiting for service to be ready..."
            sleep 15
            
            # Check service status
            echo "✅ Service status:"
            docker service ps diffractwd_web --no-trunc --format "table {{.Name}}\t{{.CurrentState}}\t{{.Error}}"
            
            # Save deployed version
            echo "${IMAGE_TAG}" > .deployed-version
            echo "✅ Deployment complete!"
          EOF

      - name: ✅ Verify deployment
        run: |
          echo "🔍 Verifying deployment..."
          EXPECTED="${{ github.sha }}"
          for i in $(seq 1 30); do
            LIVE_COMMIT=$(curl -sf "https://diffractwd.com/api/version" 2>/dev/null | jq -r '.commit // empty') || true
            if [ "$LIVE_COMMIT" = "$EXPECTED" ]; then
              echo "✅ Deployment verified! Live commit: $LIVE_COMMIT"
              echo "deployment-status=success" >> $GITHUB_OUTPUT
              exit 0
            fi
            echo "⏳ Attempt $i/30 — got: ${LIVE_COMMIT:-no response}, want: ${EXPECTED:0:8}"
            sleep 10
          done
          echo "❌ Deployment verification failed — live version does not match expected commit"
          exit 1

      - name: 🧹 Cleanup
        if: always()
        run: |
          rm -f ~/.ssh/deploy_key
          echo "🧹 Cleanup complete"

  deployment-summary:
    name: 📋 Deployment Summary
    needs: [build-and-push, deploy]
    if: always()
    runs-on: ubuntu-latest

    steps:
      - name: 📊 Generate summary
        uses: actions/github-script@v9
        with:
          script: |
            const buildResult = '${{ needs.build-and-push.result }}';
            const deployResult = '${{ needs.deploy.result }}';
            const imageTag = '${{ needs.build-and-push.outputs.image-tag }}';
            const commitSha = '${{ github.sha }}';
            const commitMessage = `${{ github.event.head_commit.message }}` || 'Manual deployment';
            const eventName = '${{ github.event_name }}';
            const triggerType = eventName === 'workflow_dispatch' ? 'Manual' : 'Automatic (push)';

            let status = '✅ SUCCESS';
            let emoji = '🎉';

            if (buildResult === 'failure') {
              status = '❌ FAILED - Build';
              emoji = '🔨';
            } else if (deployResult === 'failure') {
              status = '❌ FAILED - Deployment';
              emoji = '🚨';
            }

            const summary = `${emoji} **Deployment ${status}**

            **Commit:** \`${commitSha.substring(0, 8)}\`
            **Message:** ${commitMessage}
            **Branch:** master
            **Trigger:** ${triggerType}

            **Pipeline Results:**
            - 🐳 Build & Push: ${buildResult === 'success' ? '✅' : '❌'} ${buildResult}
            - 🚀 Deployment: ${deployResult === 'success' ? '✅' : '❌'} ${deployResult}

            **Details:**
            - **Image Tag:** \`${imageTag}\`
            - **Registry:** ghcr.io/vreshch/diffractwd.com
            - **Server:** diffractwd.com
            - **Deployment URL:** https://diffractwd.com

            **Quick Actions:**
            - 📋 [Workflow Run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
            - 🌐 [Visit Website](https://diffractwd.com)
            - 📦 [Registry](https://github.com/${{ github.repository }}/pkgs/container/diffractwd.com)

            ---
            ⏰ Generated at: \`${new Date().toISOString()}\``;

            console.log(summary);

            // Create commit status
            try {
              await github.rest.repos.createCommitStatus({
                owner: context.repo.owner,
                repo: context.repo.repo,
                sha: commitSha,
                state: deployResult === 'success' ? 'success' : 'failure',
                target_url: `https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}`,
                description: `Deployment ${status}`,
                context: 'deployment/production'
              });
            } catch (error) {
              console.log('Could not create commit status:', error.message);
            }