cd-dev.yml

name: CD Pipeline - Dev Deploy

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: cd-dev
  cancel-in-progress: true

jobs:
  deploy:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    env:
      DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ env.DEPLOY_SHA }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: picokosmos
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            docker.io/picokosmos/spring-app:dev
            docker.io/picokosmos/spring-app:dev-${{ env.DEPLOY_SHA }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Deploy to Dev Server
        uses: appleboy/ssh-action@v1.0.3
        env:
          APP_DIR: ${{ secrets.APP_DIR }}
        with:
          host: ${{ secrets.DEV_HOST }}
          username: ${{ secrets.DEV_USER }}
          key: ${{ secrets.DEV_SSH_KEY }}
          port: ${{ secrets.DEV_SSH_PORT }}
          envs: APP_DIR
          script: |
            set -euo pipefail
            if [ -n "${APP_DIR:-}" ]; then
              cd "$APP_DIR"
            else
              cd ~/app
            fi

            # Create/update .env file with secrets
            cat > .env << 'EOF'
            SPRING_MAIL_USERNAME=${{ secrets.SPRING_MAIL_USERNAME }}
            SPRING_MAIL_PASSWORD=${{ secrets.SPRING_MAIL_PASSWORD }}
            DB_PASSWORD=${{ secrets.DB_PASSWORD }}
            MYSQL_ROOT_PASSWORD=${{ secrets.MYSQL_ROOT_PASSWORD }}
            JWT_SECRET=${{ secrets.JWT_SECRET }}
            SENDGRID_API_KEY=${{ secrets.SENDGRID_API_KEY }}
            GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}
            GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}
            GOOGLE_REDIRECT_URI=${{ secrets.DEV_GOOGLE_REDIRECT_URI }}
            EMAIL_SERVICE_DOMAIN=${{ secrets.DEV_EMAIL_SERVICE_DOMAIN }}
            EOF

            # Pull latest docker-compose file
            curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/${{ env.DEPLOY_SHA }}/docker-compose.dev.yml -o docker-compose.yml

            # Pull latest images and restart
            docker compose pull
            docker compose up -d

            # Clean up old images
            docker image prune -f

            # Show status
            echo "=== Container Status ==="
            docker compose ps

            # Wait for app to be healthy
            echo "=== Waiting for app to start ==="
            sleep 30
            docker compose logs --tail=50 app

      - name: Health check
        uses: appleboy/ssh-action@v1.0.3
        env:
          APP_DIR: ${{ secrets.APP_DIR }}
        with:
          host: ${{ secrets.DEV_HOST }}
          username: ${{ secrets.DEV_USER }}
          key: ${{ secrets.DEV_SSH_KEY }}
          port: ${{ secrets.DEV_SSH_PORT }}
          envs: APP_DIR
          script: |
            set -euo pipefail
            if [ -n "${APP_DIR:-}" ]; then
              cd "$APP_DIR"
            else
              cd ~/app
            fi

            echo "=== Waiting for app to be healthy ==="
            for i in {1..30}; do
              if curl -sf http://localhost:8080/actuator/health > /dev/null 2>&1; then
                echo "App is healthy!"
                exit 0
              fi
              echo "Attempt $i/30: App not ready yet, waiting 30s..."
              sleep 30
            done

            echo "App failed to start. Logs:"
            docker compose logs --tail=100
            exit 1