deploy-dev.yml

name: Promise Tracker | Deploy | Dev

on:
  push:
    branches: [main]

concurrency:
  group: "${{ github.workflow }} @ ${{ github.ref }}"
  cancel-in-progress: true

# Least-privilege default for GITHUB_TOKEN. Deployment authenticates to
# DockerHub/Dokku via dedicated secrets, not the workflow token.
permissions:
  contents: read

jobs:
  # Mandatory verification gate. Deployment cannot run when this fails.
  verify:
    uses: ./.github/workflows/verify.yml

  # Build the immutable runtime + migrator images once (no reachable DB needed).
  build:
    needs: verify
    uses: ./.github/workflows/build-image.yml
    with:
      image_name: "codeforafrica/promisetracker-v2"
      next_public_app_url: "https://promisetracker-v2.dev.codeforafrica.org"
      sentry_environment: "development"
    secrets:
      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
      SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}

  # Migrate once, then promote the exact digest, then verify readiness.
  deploy:
    needs: build
    uses: ./.github/workflows/promote.yml
    with:
      environment: development
      app_name: promisetracker-v2
      dokku_remote_url: "ssh://azureuser@ui-1.dev.codeforafrica.org"
      app_url: "https://promisetracker-v2.dev.codeforafrica.org"
      image_name: "codeforafrica/promisetracker-v2"
      runtime_digest: ${{ needs.build.outputs.runtime_digest }}
      migrator_digest: ${{ needs.build.outputs.migrator_digest }}
    secrets:
      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
      DATABASE_URI: ${{ secrets.DATABASE_URI }}
      PAYLOAD_SECRET: ${{ secrets.PAYLOAD_SECRET }}