cd.yml

name: 🚀 Deployment

# One workflow, two target deployment environments: staging and production.
# Triggered automatically upon PR merge:
#   - PR merged into 'stg'  (push to branch stg)  -> deploys to Staging (staging)
#   - PR merged into 'main' (push to branch main) -> deploys to Production (production)
# Also supports manual trigger via workflow_dispatch.
#
# Both environments execute the exact same deployment and rollback steps.
# The only difference is the GitHub Environment settings containing the 5 variables/secrets:
#   1. NETBIRD_KEY / NETBIRD_SETUP_KEY
#   2. SERVER_HOST
#   3. SERVER_USER
#   4. SERVER_PROJECT_DIR
#   5. SSH_PRIVATE_KEY
on:
  push:
    branches:
      - stg
      - main
  workflow_dispatch:
    inputs:
      environment:
        description: "Environment to redeploy (staging or production)"
        type: choice
        required: true
        options:
          - staging
          - production

permissions:
  contents: read

jobs:
  resolve:
    name: 🧭 Resolve Target Environment
    runs-on: ubuntu-latest
    outputs:
      environment: ${{ steps.map.outputs.environment }}
    steps:
      - name: Map Event to Target Environment
        id: map
        env:
          EVENT: ${{ github.event_name }}
          REF: ${{ github.ref }}
          CHOICE: ${{ inputs.environment }}
        run: |
          case "$EVENT:$REF" in
            push:refs/heads/stg)  TARGET=staging ;;
            push:refs/heads/main) TARGET=production ;;
            workflow_dispatch:*)  TARGET="$CHOICE" ;;
            *) echo "::error::No deployment environment configured for event '$EVENT' on '$REF'."; exit 1 ;;
          esac
          case "$TARGET:$REF" in
            staging:refs/heads/stg|production:refs/heads/main) ;;
            *) echo "::error::Environment '$TARGET' can only deploy from branch 'stg' (staging) or 'main' (production), not from '$REF'."; exit 1 ;;
          esac
          echo "environment=$TARGET" >> "$GITHUB_OUTPUT"
          echo "Target environment: **$TARGET** (from \`$REF\`, commit \`${GITHUB_SHA::7}\`)" >> "$GITHUB_STEP_SUMMARY"

  deploy:
    name: 🚀 Deploy to ${{ needs.resolve.outputs.environment }}
    needs: resolve
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment:
      name: ${{ needs.resolve.outputs.environment }}
      url: ${{ steps.record.outputs.url }}
    concurrency:
      group: cd-${{ needs.resolve.outputs.environment }}
      cancel-in-progress: false

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: 🔍 Validate Deployment Secrets & Variables
        uses: ./.github/actions/preflight-check
        with:
          environment: ${{ needs.resolve.outputs.environment }}
          netbird-setup-key: ${{ secrets.NETBIRD_KEY || secrets.NETBIRD_SETUP_KEY }}
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
          netbird-management-url: ${{ vars.NETBIRD_MANAGEMENT_URL }}
          server-host: ${{ vars.SERVER_HOST }}
          server-user: ${{ vars.SERVER_USER }}
          server-project-dir: ${{ vars.SERVER_PROJECT_DIR }}

      - name: 🛡️ Verify Sensitive Data Guard
        run: bash scripts/check-data-guard.sh

      - name: 🐳 Validate Docker Compose Configuration
        run: |
          if [ -f "docker-compose.yml" ]; then
            cp .env.example .env 2>/dev/null || true
            docker compose config --quiet
            rm -f .env
          fi

      - name: 🌐 Connect to NetBird VPN Mesh
        uses: ./.github/actions/netbird-connect
        with:
          management-url: ${{ vars.NETBIRD_MANAGEMENT_URL }}
          setup-key: ${{ secrets.NETBIRD_KEY || secrets.NETBIRD_SETUP_KEY }}
          server-host: ${{ vars.SERVER_HOST }}

      - name: 🔑 Setup SSH Authentication
        uses: ./.github/actions/ssh-setup
        with:
          ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}
          server-host: ${{ vars.SERVER_HOST }}

      - name: 🚀 Update Repository and Deploy via SSH
        uses: ./.github/actions/ssh-exec
        with:
          server-host: ${{ vars.SERVER_HOST }}
          server-user: ${{ vars.SERVER_USER }}
          cmd: |
            set -e
            AUTH_REPO="https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
            TARGET_DIR="${{ vars.SERVER_PROJECT_DIR }}"

            # First deployment: initialize in place if directory doesn't have .git
            if [ ! -d "$TARGET_DIR/.git" ]; then
              echo "First deployment: preparing $TARGET_DIR (existing .env is preserved)..."
              sudo mkdir -p "$TARGET_DIR"
              sudo chown -R "$(id -u):$(id -g)" "$TARGET_DIR"
              git -C "$TARGET_DIR" init -q
              git -C "$TARGET_DIR" remote add origin "$AUTH_REPO"
            fi

            cd "$TARGET_DIR"
            git remote set-url origin "$AUTH_REPO"
            git fetch -q origin --tags

            # 1. Check last verified stable deployment
            STABLE_REV="$(cat .deploy_success 2>/dev/null || true)"
            if [ -z "$STABLE_REV" ]; then
              STABLE_REV="$(git rev-parse -q --verify HEAD 2>/dev/null || true)"
            fi
            echo "Last verified deployment on this host: ${STABLE_REV:-none (first deployment)}"

            echo "Checking out ${{ github.ref_name }} (${{ github.sha }})..."
            git checkout -q -f ${{ github.sha }}

            echo "Running deployment and smoke tests..."
            if ! bash scripts/deploy.sh; then
              echo "=========================================================="
              echo "🚨 DEPLOYMENT OR SMOKE TEST FAILED!"
              if [ -z "$STABLE_REV" ]; then
                echo "This was the first deployment on this host: nothing to roll back to."
                echo "=========================================================="
                exit 1
              fi
              echo "Rolling back to last verified deployment: ${STABLE_REV}"
              echo "=========================================================="
              git checkout -q -f "${STABLE_REV}"
              bash scripts/deploy.sh
              echo "✅ Rollback to ${STABLE_REV} complete. Server restored to verified stable baseline."
              echo "Failing workflow per Fail Forward policy."
              exit 1
            fi

            # 2. Record new commit only after deployment and smoke tests pass
            echo "${{ github.sha }}" > .deploy_success
            echo "✅ Deployment verified! Recorded ${{ github.ref_name }} (${{ github.sha }}) as new stable baseline."

      - name: 🔗 Record Environment URL
        id: record
        env:
          SERVER_HOST: ${{ vars.SERVER_HOST }}
        run: echo "url=http://${SERVER_HOST}:${FASTAPI_PORT:-8000}" >> "$GITHUB_OUTPUT"