deploy.yml

name: Shared Deploy

on:
  workflow_call:
    inputs:
      runner:
        description: >-
          Runner the jobs run on, as a JSON array of labels. Defaults to the self-hosted runner of the
          organisation in Helsinki; pass another array, such as '["ubuntu-latest"]', for a job that
          really needs a GitHub-hosted VM.
        required: false
        type: string
        default: '["self-hosted", "helsinki"]'
      environment:
        description: Target environment name (dev, staging, prod).
        required: true
        type: string
      image_name:
        description: Image name without tag. Defaults to ghcr.io/<repo>.
        required: false
        type: string
        default: ''
      image_tag:
        description: Explicit tag to deploy (e.g. sha-<commit> for a rollback). Defaults to the environment mapping (prod -> main, otherwise <environment>).
        required: false
        type: string
        default: ''
      health_url:
        description: URL polled after deploy to confirm the app is healthy.
        required: true
        type: string
    secrets:
      WATCHTOWER_URL:
        required: true
      WATCHTOWER_TOKEN:
        required: true

permissions:
  contents: read

jobs:
  deploy:
    name: Deploy ${{ inputs.environment }}
    runs-on: ${{ fromJSON(inputs.runner) }}
    timeout-minutes: 15
    environment: ${{ inputs.environment }}
    steps:
      - name: Resolve image reference
        id: image
        env:
          IMAGE_NAME: ${{ inputs.image_name }}
          IMAGE_TAG: ${{ inputs.image_tag }}
          REPOSITORY: ${{ github.repository }}
          ENVIRONMENT: ${{ inputs.environment }}
        run: |
          name="${IMAGE_NAME:-ghcr.io/${REPOSITORY}}"
          name="${name,,}"

          tag="$IMAGE_TAG"
          if [ -z "$tag" ]; then
            case "$ENVIRONMENT" in
              prod) tag="main" ;;
              *) tag="$ENVIRONMENT" ;;
            esac
          fi

          echo "ref=${name}:${tag}" >> "$GITHUB_OUTPUT"
          echo "Triggering update for: ${name}:${tag}"

      - name: Trigger Watchtower update
        env:
          WATCHTOWER_URL: ${{ secrets.WATCHTOWER_URL }}
          WATCHTOWER_TOKEN: ${{ secrets.WATCHTOWER_TOKEN }}
          IMAGE_REF: ${{ steps.image.outputs.ref }}
        run: |
          response="$(curl -fsS -X POST -G \
            --retry 3 --retry-delay 5 --max-time 300 \
            -H "Authorization: Bearer $WATCHTOWER_TOKEN" \
            --data-urlencode "image=$IMAGE_REF" \
            "$WATCHTOWER_URL/v1/update")"
          echo "$response" | jq .

          failed="$(echo "$response" | jq -r '.summary.failed // 0')"
          updated="$(echo "$response" | jq -r '.summary.updated // 0')"

          if [ "$failed" != "0" ]; then
            echo "::error::Watchtower reported $failed failed update(s)."
            exit 1
          fi
          if [ "$updated" = "0" ]; then
            echo "::warning::No container was updated (image already current, or no container matches $IMAGE_REF — check the watchtower label and the image tag in the compose file)."
          fi

      - name: Wait for health check
        env:
          HEALTH_URL: ${{ inputs.health_url }}
        run: |
          sleep 5
          for attempt in $(seq 1 30); do
            status="$(curl -s -o /dev/null -w '%{http_code}' "$HEALTH_URL" || echo 000)"
            if [ "$status" = "200" ]; then
              echo "Healthy after $attempt attempt(s)."
              exit 0
            fi
            echo "Attempt $attempt/30: $HEALTH_URL returned $status, retrying in 10s..."
            sleep 10
          done
          echo "::error::$HEALTH_URL did not return 200 within 5 minutes."
          exit 1