production-deploy.yml

name: Production Deployment

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      vault_contract_id:
        description: 'Mainnet Vault Contract ID (override)'
        required: false
        type: string

concurrency:
  group: production-deployment
  cancel-in-progress: false

jobs:
  # ─── Guard: parse version from tag ────────────────────────────────────────
  validate:
    name: Validate release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.parse.outputs.version }}
    steps:
      - name: Parse version from tag
        id: parse
        run: |
          if [[ "${{ github.event_name }}" == "push" ]]; then
            VERSION="${GITHUB_REF_NAME}"
          else
            VERSION="manual-$(date +%Y%m%d%H%M%S)"
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Deploying version: $VERSION"

  # ─── Frontend: lint + unit tests ──────────────────────────────────────────
  frontend-ci:
    name: Frontend CI (lint + tests)
    runs-on: ubuntu-latest
    needs: validate
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Unit tests
        run: npm run test:run

  # ─── Frontend: production build ───────────────────────────────────────────
  frontend-build:
    name: Build frontend (production)
    runs-on: ubuntu-latest
    needs: frontend-ci
    defaults:
      run:
        working-directory: frontend
    outputs:
      artifact_name: ${{ steps.meta.outputs.artifact_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Build (production mode)
        env:
          VITE_SOROBAN_RPC_URL: ${{ secrets.PROD_SOROBAN_RPC_URL }}
          VITE_STELLAR_NETWORK_PASSPHRASE: ${{ secrets.PROD_STELLAR_NETWORK_PASSPHRASE }}
          VITE_VAULT_CONTRACT_ID: ${{ inputs.vault_contract_id || secrets.PROD_VAULT_CONTRACT_ID }}
          VITE_API_BASE_URL: ${{ secrets.PROD_API_BASE_URL }}
          VITE_SENTRY_DSN: ${{ secrets.PROD_SENTRY_DSN }}
          VITE_SENTRY_ENVIRONMENT: production
          VITE_SENTRY_TRACES_SAMPLE_RATE: '0.1'
          VITE_SENTRY_REPLAYS_SESSION_SAMPLE_RATE: '0.1'
          VITE_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE: '1.0'
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          VITE_FF_ANALYTICS_PAGE: 'true'
          VITE_FF_ADVANCED_CHARTS: 'false'
          VITE_FF_DEBUG_MODE: 'false'
          NODE_ENV: production
        run: npm run build

      - name: Set artifact metadata
        id: meta
        run: echo "artifact_name=frontend-dist-${{ needs.validate.outputs.version }}" >> $GITHUB_OUTPUT

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.meta.outputs.artifact_name }}
          path: frontend/dist/
          retention-days: 30

  # ─── Deploy Frontend to Vercel (Production) ───────────────────────────────
  deploy-frontend:
    name: Deploy frontend → Vercel (production)
    runs-on: ubuntu-latest
    needs: [validate, frontend-build]
    environment:
      name: production
      url: ${{ steps.deploy.outputs.production_url }}
    outputs:
      production_url: ${{ steps.deploy.outputs.production_url }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Vercel CLI
        run: npm install --global vercel@latest

      - name: Download build artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.frontend-build.outputs.artifact_name }}
          path: frontend/dist/

      - name: Pull Vercel environment info
        working-directory: frontend
        run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}

      - name: Deploy to Vercel (production)
        id: deploy
        working-directory: frontend
        run: |
          DEPLOY_URL=$(vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} 2>&1 | tail -1)
          echo "production_url=$DEPLOY_URL" >> $GITHUB_OUTPUT
          echo "Deployed to: $DEPLOY_URL"

  # ─── Smoke test the production URL ────────────────────────────────────────
  smoke-test:
    name: Smoke test production URL
    runs-on: ubuntu-latest
    needs: deploy-frontend
    steps:
      - name: Check production URL is reachable
        run: |
          PROD_URL="${{ needs.deploy-frontend.outputs.production_url }}"
          echo "Testing $PROD_URL ..."
          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 30 "$PROD_URL" || echo "000")
          if [[ "$HTTP_STATUS" == "200" ]]; then
            echo "Production URL is accessible (HTTP $HTTP_STATUS)"
          else
            echo "Unexpected HTTP status: $HTTP_STATUS"
          fi

      - name: Verify response contains expected content
        run: |
          PROD_URL="${{ needs.deploy-frontend.outputs.production_url }}"
          BODY=$(curl -s --max-time 30 "$PROD_URL" || echo "")
          if echo "$BODY" | grep -qi "YieldVault"; then
            echo "Response contains expected YieldVault content"
          else
            echo "Response body check inconclusive - verify manually at $PROD_URL"
          fi

  # ─── Post deployment summary ──────────────────────────────────────────────
  notify:
    name: Deployment summary
    runs-on: ubuntu-latest
    needs: [validate, deploy-frontend, smoke-test]
    if: always()
    steps:
      - name: Post deployment summary
        uses: actions/github-script@v7
        with:
          script: |
            const version    = '${{ needs.validate.outputs.version }}';
            const prodUrl    = '${{ needs.deploy-frontend.outputs.production_url }}';
            const status     = '${{ needs.smoke-test.result }}';
            const statusIcon = status === 'success' ? 'success' : 'warning';

            await core.summary
              .addHeading(`Production Deployment - ${version}`)
              .addTable([
                [{data: 'Item', header: true}, {data: 'Value', header: true}],
                ['Frontend URL', `[${prodUrl}](${prodUrl})`],
                ['Version', version],
                ['Smoke Test', status],
              ])
              .write();

            if (context.eventName === 'push' && context.ref.startsWith('refs/tags/')) {
              try {
                const { data: release } = await github.rest.repos.getReleaseByTag({
                  owner: context.repo.owner,
                  repo:  context.repo.repo,
                  tag:   version,
                });
                const body = `## Production Deployment - ${version}\n\n| Item | Value |\n|------|-------|\n| Frontend URL | [${prodUrl}](${prodUrl}) |\n| Smoke Test | ${status} |\n\n_Automatically deployed by the Production Deployment workflow._`;
                await github.rest.repos.updateRelease({
                  owner:      context.repo.owner,
                  repo:       context.repo.repo,
                  release_id: release.id,
                  body:       (release.body || '') + '\n\n---\n' + body,
                });
              } catch (e) {
                console.log('Could not update release notes:', e.message);
              }
            }