ci.yml

name: CI

on:
  push:
    branches:
      - develop
  pull_request:

concurrency:
  group: >-
    ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  detect-changes:
    runs-on: ubuntu-latest

    outputs:
      surface: ${{ steps.detect.outputs.surface }}
      should_deploy: ${{ steps.detect.outputs.should_deploy }}
      reason: ${{ steps.detect.outputs.reason }}
      base_ref: ${{ steps.detect.outputs.base_ref }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Detect release surface
        id: detect
        shell: bash
        run: |
          set -euo pipefail

          if [ "${{ github.event_name }}" = "pull_request" ]; then
            base_ref='${{ github.event.pull_request.base.sha }}'
          else
            base_ref='${{ github.event.before }}'
          fi

          if [ -z "$base_ref" ] || [ "$base_ref" = "0000000000000000000000000000000000000000" ]; then
            base_ref="$(git hash-object -t tree /dev/null)"
          fi

          output="$(bash scripts/detect_release_surface.sh "$base_ref" '${{ github.sha }}')"
          printf '%s\n' "$output"
          echo "base_ref=$base_ref" >> "$GITHUB_OUTPUT"
          while IFS='=' read -r key value; do
            echo "$key=$value" >> "$GITHUB_OUTPUT"
          done <<< "$output"

      - name: Write detection summary
        shell: bash
        run: |
          {
            echo "## Change Detection"
            echo
            echo "- Event: \`${{ github.event_name }}\`"
            echo "- Base ref: \`${{ steps.detect.outputs.base_ref }}\`"
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Surface: \`${{ steps.detect.outputs.surface }}\`"
            echo "- Reason: ${{ steps.detect.outputs.reason }}"
            echo "- Should deploy: \`${{ steps.detect.outputs.should_deploy }}\`"
          } >> "$GITHUB_STEP_SUMMARY"

  production-contract:
    needs: detect-changes
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Run production contract gate
        run: bash scripts/production_contract_gate.sh
        env:
          BACKEND_PYTHON: python

      - name: Write production contract summary
        if: always()
        shell: bash
        run: |
          {
            echo "## Production Contract"
            echo
            echo "- Event: \`${{ github.event_name }}\`"
            echo "- Ref: \`${{ github.ref_name }}\`"
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Base ref: \`${{ needs.detect-changes.outputs.base_ref }}\`"
            echo "- Surface: \`${{ needs.detect-changes.outputs.surface }}\`"
            echo "- Reason: ${{ needs.detect-changes.outputs.reason }}"
            echo "- Checks: \`release_workflow_audit + runtime_capability_audit + production_env_audit + shell syntax + test_production_env_audit\`"
          } >> "$GITHUB_STEP_SUMMARY"

  release-gate:
    needs: detect-changes
    if: needs.detect-changes.outputs.should_deploy == '1'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node
        if: needs.detect-changes.outputs.surface == 'frontend' || needs.detect-changes.outputs.surface == 'full'
        uses: actions/setup-node@v6
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        if: needs.detect-changes.outputs.surface == 'frontend' || needs.detect-changes.outputs.surface == 'full'
        run: npm --prefix frontend ci

      - name: Setup Python
        if: needs.detect-changes.outputs.surface == 'backend' || needs.detect-changes.outputs.surface == 'full'
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install backend dependencies
        if: needs.detect-changes.outputs.surface == 'backend' || needs.detect-changes.outputs.surface == 'full'
        run: python -m pip install -r backend/requirements.txt

      - name: Run release workflow
        run: bash scripts/release_workflow.sh --surface "${{ needs.detect-changes.outputs.surface }}"
        env:
          BACKEND_PYTHON: python

      - name: Write release gate summary
        if: always()
        shell: bash
        run: |
          {
            echo "## Release Gate"
            echo
            echo "- Event: \`${{ github.event_name }}\`"
            echo "- Ref: \`${{ github.ref_name }}\`"
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Base ref: \`${{ needs.detect-changes.outputs.base_ref }}\`"
            echo "- Surface: \`${{ needs.detect-changes.outputs.surface }}\`"
            echo "- Reason: ${{ needs.detect-changes.outputs.reason }}"
            echo "- Frontend deps: \`${{ (needs.detect-changes.outputs.surface == 'frontend' || needs.detect-changes.outputs.surface == 'full') && 'installed' || 'skipped' }}\`"
            echo "- Backend deps: \`${{ (needs.detect-changes.outputs.surface == 'backend' || needs.detect-changes.outputs.surface == 'full') && 'installed' || 'skipped' }}\`"
          } >> "$GITHUB_STEP_SUMMARY"

  release-gate-skipped:
    needs: detect-changes
    if: needs.detect-changes.outputs.should_deploy != '1'
    runs-on: ubuntu-latest

    steps:
      - name: Write skipped release gate summary
        shell: bash
        run: |
          {
            echo "## Release Gate"
            echo
            echo "- Event: \`${{ github.event_name }}\`"
            echo "- Ref: \`${{ github.ref_name }}\`"
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Base ref: \`${{ needs.detect-changes.outputs.base_ref }}\`"
            echo "- Surface: \`${{ needs.detect-changes.outputs.surface }}\`"
            echo "- Reason: ${{ needs.detect-changes.outputs.reason }}"
            echo "- Status: skipped"
          } >> "$GITHUB_STEP_SUMMARY"

  staging-release:
    needs:
      - detect-changes
      - production-contract
      - release-gate
    if: >-
      github.event_name == 'push' &&
      github.ref == 'refs/heads/develop' &&
      needs.detect-changes.outputs.should_deploy == '1' &&
      needs.production-contract.result == 'success' &&
      needs.release-gate.result == 'success'
    runs-on: ubuntu-latest
    environment: staging

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Run staging release
        id: remote_release
        uses: ./.github/actions/remote-release
        with:
          surface: ${{ needs.detect-changes.outputs.surface }}
          deploy_host: ${{ secrets.DEPLOY_HOST }}
          base_url: ${{ secrets.DEPLOYMATE_BASE_URL }}
          admin_username: ${{ secrets.DEPLOYMATE_ADMIN_USERNAME }}
          admin_password: ${{ secrets.DEPLOYMATE_ADMIN_PASSWORD }}
          deploy_ssh_private_key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
          deploy_ssh_known_hosts: ${{ secrets.DEPLOY_SSH_KNOWN_HOSTS }}
          runtime_smoke_enabled: '1'
          deploy_repo_dir: ${{ secrets.DEPLOY_REPO_DIR }}
          deploy_branch: ${{ secrets.DEPLOY_BRANCH }}
          deploy_ref: ${{ github.sha }}
          deploy_env_file: ${{ secrets.DEPLOY_ENV_FILE }}
          runtime_smoke_ssh_private_key: ${{ secrets.RUNTIME_SMOKE_SSH_PRIVATE_KEY }}
          runtime_smoke_server_id: ${{ secrets.RUNTIME_SMOKE_SERVER_ID }}
          runtime_smoke_server_name: ${{ secrets.RUNTIME_SMOKE_SERVER_NAME }}
          runtime_smoke_server_host: ${{ secrets.RUNTIME_SMOKE_SERVER_HOST }}
          runtime_smoke_server_port: ${{ secrets.RUNTIME_SMOKE_SERVER_PORT }}
          runtime_smoke_server_username: ${{ secrets.RUNTIME_SMOKE_SERVER_USERNAME }}
          runtime_smoke_image: ${{ secrets.RUNTIME_SMOKE_IMAGE }}
          runtime_smoke_internal_port: ${{ secrets.RUNTIME_SMOKE_INTERNAL_PORT }}
          runtime_smoke_external_port: ${{ secrets.RUNTIME_SMOKE_EXTERNAL_PORT }}
          runtime_smoke_start_port: ${{ secrets.RUNTIME_SMOKE_START_PORT }}
          runtime_smoke_health_timeout: ${{ secrets.RUNTIME_SMOKE_HEALTH_TIMEOUT }}

      - name: Write staging summary
        if: always()
        shell: bash
        run: |
          {
            echo "## Staging Deploy"
            echo
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Deployed SHA: \`${{ steps.remote_release.outputs.deployed_sha || 'unavailable' }}\`"
            echo "- Surface: \`${{ needs.detect-changes.outputs.surface }}\`"
            echo "- Reason: ${{ needs.detect-changes.outputs.reason }}"
            echo "- Should deploy: \`${{ needs.detect-changes.outputs.should_deploy }}\`"
            echo "- Smoke mode: \`${{ steps.remote_release.outputs.smoke_mode || 'runtime enabled' }}\`"
            echo "- URL: ${{ steps.remote_release.outputs.target_url || secrets.DEPLOYMATE_BASE_URL }}"
            echo "- Actions run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Notify staging result
        if: always()
        continue-on-error: true
        shell: bash
        env:
          DEPLOY_NOTIFICATION_WEBHOOK: ${{ secrets.DEPLOY_NOTIFICATION_WEBHOOK }}
        run: |
          if [ -z "$DEPLOY_NOTIFICATION_WEBHOOK" ]; then
            echo "[notify] DEPLOY_NOTIFICATION_WEBHOOK is not configured"
            exit 0
          fi

          bash scripts/send_workflow_notification.sh \
            --webhook-url "$DEPLOY_NOTIFICATION_WEBHOOK" \
            --workflow "Auto staging deploy" \
            --environment "staging" \
            --status "${{ job.status }}" \
            --surface "${{ needs.detect-changes.outputs.surface }}" \
            --smoke "${{ steps.remote_release.outputs.smoke_mode || 'runtime enabled' }}" \
            --commit "${{ github.sha }}" \
            --ref "${{ github.ref_name }}" \
            --run-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            --details "${{ needs.detect-changes.outputs.reason }}"