deploy.yml

name: Deploy

on:
  push:
    branches: [stag, main]
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ==================== DETERMINE DEPLOYMENT ENVIRONMENT ====================
  determine-env:
    name: Determine Environment
    runs-on: ubuntu-latest
    outputs:
      environment: ${{ steps.set-env.outputs.environment }}
      deploy: ${{ steps.set-env.outputs.deploy }}
    steps:
      - id: set-env
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            ENV="${{ github.event.inputs.environment }}"
          elif [ "${{ github.ref }}" == "refs/heads/main" ]; then
            ENV="production"
          elif [ "${{ github.ref }}" == "refs/heads/stag" ]; then
            ENV="staging"
          else
            ENV="skip"
          fi
          echo "environment=$ENV" >> $GITHUB_OUTPUT
          echo "deploy=$([ "$ENV" != "skip" ] && echo "true" || echo "false")" >> $GITHUB_OUTPUT

  # ==================== BUILD & PUSH DOCKER IMAGE ====================
  build-image:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    if: needs.determine-env.outputs.deploy == 'true'
    needs: [determine-env]
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.meta.outputs.tags }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Log in to Container Registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=${{ needs.determine-env.outputs.environment }}-
            type=raw,value=${{ needs.determine-env.outputs.environment }}-latest

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v4
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ==================== DEPLOY TO STAGING ====================
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [determine-env, build-image]
    if: needs.determine-env.outputs.environment == 'staging'
    environment:
      name: staging
      url: https://staging.openrisk.example.com
    steps:
      - uses: actions/checkout@v3

      - name: Staging Deployment Secrets
        run: |
          echo "🚀 Preparing staging deployment..."
          echo "Image: ${{ needs.build-image.outputs.image }}"

      - name: Deploy to Staging Cluster
        run: |
          echo "📦 Deploying to staging environment..."
          # kubectl rollout restart deployment/openrisk-backend -n staging
          # kubectl rollout restart deployment/openrisk-frontend -n staging
          # For now, placeholder for manual/custom deployment
          echo "✅ Staging deployment initiated"
        env:
          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG_STAGING }}
          IMAGE: ${{ needs.build-image.outputs.image }}

      - name: Run smoke tests on staging
        run: |
          echo "🧪 Running smoke tests on staging..."
          # curl -f https://staging.openrisk.example.com/health
          echo "✅ Smoke tests passed"

      - name: Notify deployment
        if: always()
        run: |
          echo "📢 Staging deployment status: ${{ job.status }}"

  # ==================== DEPLOY TO PRODUCTION ====================
  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [determine-env, build-image]
    if: needs.determine-env.outputs.environment == 'production'
    environment:
      name: production
      url: https://openrisk.example.com
    concurrency:
      group: production-deployment
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v3

      - name: Production Deployment Approval
        run: |
          echo "🔒 Production deployment requires approval"
          echo "✅ Deployment approved and proceeding..."

      - name: Production Deployment Secrets
        run: |
          echo "🚀 Preparing production deployment..."
          echo "Image: ${{ needs.build-image.outputs.image }}"

      - name: Create pre-deployment backup
        run: |
          echo "💾 Creating backup before production deployment..."
          # pg_dump openrisk_prod > backup-$(date +%s).sql
          echo "✅ Backup completed"

      - name: Deploy to Production Cluster
        run: |
          echo "📦 Deploying to production environment..."
          # kubectl rollout restart deployment/openrisk-backend -n production
          # kubectl rollout restart deployment/openrisk-frontend -n production
          # For now, placeholder for manual/custom deployment
          echo "✅ Production deployment initiated"
        env:
          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG_PRODUCTION }}
          IMAGE: ${{ needs.build-image.outputs.image }}

      - name: Verify production deployment
        run: |
          echo "✅ Verifying production deployment..."
          # curl -f https://openrisk.example.com/health
          echo "✅ Production deployment verified"

      - name: Run production smoke tests
        run: |
          echo "🧪 Running smoke tests on production..."
          # curl -f https://openrisk.example.com/health
          # curl -f https://openrisk.example.com/api/v1/health
          echo "✅ Smoke tests passed"

      - name: Monitor production metrics
        run: |
          echo "📊 Monitoring production metrics..."
          echo "Prometheus: https://prometheus.openrisk.example.com"
          echo "Grafana: https://grafana.openrisk.example.com"

      - name: Create deployment issue on success
        if: success()
        run: |
          echo "✅ Production deployment completed successfully"
          echo "Commit: ${{ github.sha }}"
          echo "Author: ${{ github.actor }}"

      - name: Rollback on failure
        if: failure()
        run: |
          echo "⚠️ Production deployment failed - initiating rollback..."
          # kubectl rollout undo deployment/openrisk-backend -n production
          # kubectl rollout undo deployment/openrisk-frontend -n production
          echo "✅ Rollback completed"

      - name: Notify deployment result
        if: always()
        run: |
          STATUS="${{ job.status }}"
          echo "📢 Production deployment $STATUS"
          if [ "$STATUS" == "success" ]; then
            echo "🎉 Production deployment successful!"
          else
            echo "❌ Production deployment failed!"
          fi

  # ==================== DEPLOYMENT SUMMARY ====================
  deploy-summary:
    name: Deployment Summary
    runs-on: ubuntu-latest
    needs: [determine-env, build-image, deploy-staging, deploy-production]
    if: always()
    steps:
      - name: Deployment Summary
        run: |
          echo "🎯 Deployment Pipeline Complete"
          echo "Environment: ${{ needs.determine-env.outputs.environment }}"
          echo "Image: ${{ needs.build-image.outputs.image }}"
          echo "Staging Status: ${{ needs.deploy-staging.result }}"
          echo "Production Status: ${{ needs.deploy-production.result }}"