cd.yml

name: CD

# Phase E — auto-deploy to PRODUCTION (namespace `project-01` on the Hetzner k8s
# cluster) via Helm whenever CI succeeds on `main`. No more manual `helm upgrade` /
# `kubectl rollout` from a workstation.
#
# CI's `build-images` job has already pushed
#   ghcr.io/loopless-portal/loopless-{backend,frontend}:sha-<commit>
# before this workflow runs, so we pin the chart to that exact SHA.
#
# Pre-reqs in the cluster (one-time setup — see devops/k8s/project-01/README.md):
#   * Secret  `ghcr-pull`        (GHCR image-pull secret)
#   * Secret  `loopless-secrets` (DB / RabbitMQ / Keycloak / MinIO / PAT)
#   * CfgMap  `keycloak-realm`   (realm import)
# Repo secret required by this workflow:
#   * KUBECONFIG_PROJECT_01 — base64 of the project-01 kubeconfig
#       cat project-01.kubeconfig | base64 -w0   # then paste into the repo secret
on:
  workflow_run:
    workflows: ["CI"]
    types:
      - completed
    branches:
      - main
  # Manual re-deploy of any commit (defaults to the latest main commit).
  workflow_dispatch:
    inputs:
      image_sha:
        description: "Git SHA to deploy (blank = the SHA this workflow checks out)."
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: cd-project-01
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy to project-01
    runs-on: ubuntu-latest
    # workflow_dispatch always runs; the CI-triggered path only on a green CI run.
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}

    environment:
      name: production-project-01
      url: https://web.project-01.gjirafa.dev

    env:
      RELEASE: loopless
      NAMESPACE: project-01
      CHART_PATH: devops/helm/loopless
      HEALTH_URL: https://api.project-01.gjirafa.dev/health/ready
      # Generous: Helm blocks on the post-upgrade migrate Job, then pods roll.
      DEPLOY_TIMEOUT: 8m

    outputs:
      status: ${{ steps.result.outputs.status }}
      sha: ${{ steps.sha.outputs.value }}

    steps:
      - name: Resolve deploy SHA
        id: sha
        shell: bash
        run: |
          SHA="${{ github.event.inputs.image_sha }}"
          if [ -z "$SHA" ]; then
            SHA="${{ github.event.workflow_run.head_sha || github.sha }}"
          fi
          echo "value=${SHA}" >> "$GITHUB_OUTPUT"
          echo "Deploying commit ${SHA}"

      - name: Checkout deploy commit
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.sha.outputs.value }}

      - name: Install kubectl
        uses: azure/setup-kubectl@v4
        with:
          version: v1.30.0

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.16.3

      - name: Configure kubeconfig
        shell: bash
        env:
          KUBECONFIG_PROJECT_01: ${{ secrets.KUBECONFIG_PROJECT_01 }}
        run: |
          if [ -z "$KUBECONFIG_PROJECT_01" ]; then
            echo "::error::KUBECONFIG_PROJECT_01 secret is not set."
            exit 1
          fi
          mkdir -p "$HOME/.kube"
          printf '%s' "$KUBECONFIG_PROJECT_01" | base64 -d > "$HOME/.kube/config"
          chmod 600 "$HOME/.kube/config"
          kubectl config current-context

      - name: Helm upgrade (pin images to commit SHA)
        shell: bash
        env:
          IMAGE_TAG: sha-${{ steps.sha.outputs.value }}
        run: |
          # NO --wait: the migrate Job is a post-upgrade hook and Helm already blocks on
          # hooks until they complete. --wait would deadlock — backend readiness depends
          # on the migration that only runs inside that hook. Helm returns once the
          # migration Job has succeeded; the app pods roll concurrently.
          helm upgrade --install "${RELEASE}" "${CHART_PATH}" \
            --namespace "${NAMESPACE}" \
            --set image.backend.tag="${IMAGE_TAG}" \
            --set image.frontend.tag="${IMAGE_TAG}" \
            --timeout "${DEPLOY_TIMEOUT}"

      - name: Wait for backend rollout
        shell: bash
        run: kubectl -n "${NAMESPACE}" rollout status deployment/loopless-backend --timeout="${DEPLOY_TIMEOUT}"

      - name: Wait for frontend rollout
        shell: bash
        run: kubectl -n "${NAMESPACE}" rollout status deployment/loopless-frontend --timeout="${DEPLOY_TIMEOUT}"

      - name: Health check
        shell: bash
        run: |
          for attempt in 1 2 3 4 5 6; do
            if curl -fsS --max-time 10 "${HEALTH_URL}"; then
              echo "Health check passed on attempt ${attempt}."
              exit 0
            fi
            echo "Health check attempt ${attempt} failed; retrying in 10s..."
            sleep 10
          done
          echo "::error::Health check failed after 6 attempts (${HEALTH_URL})."
          exit 1

      - name: Roll back on failure
        if: failure()
        shell: bash
        run: |
          echo "::warning::Deploy failed — rolling back to the previous Helm revision."
          helm rollback "${RELEASE}" -n "${NAMESPACE}" --timeout "${DEPLOY_TIMEOUT}" || \
            echo "::error::helm rollback failed — manual intervention required."

      - name: Record result
        id: result
        if: always()
        shell: bash
        run: echo "status=${{ job.status }}" >> "$GITHUB_OUTPUT"

  notify:
    name: Discord Notify
    runs-on: ubuntu-latest
    needs:
      - deploy
    if: always()

    steps:
      - name: Send Discord notification
        if: env.DISCORD_WEBHOOK_URL != ''
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          DEPLOY_RESULT: ${{ needs.deploy.result }}
          COMMIT_SHA: ${{ needs.deploy.outputs.sha }}
          COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ needs.deploy.outputs.sha }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        shell: bash
        run: |
          case "$DEPLOY_RESULT" in
            success)   LINE=":rocket: success" ;;
            failure)   LINE=":x: failed (rolled back)" ;;
            cancelled) LINE=":warning: cancelled" ;;
            skipped)   LINE=":pause_button: skipped" ;;
            *)         LINE=":grey_question: $DEPLOY_RESULT" ;;
          esac
          SHORT_SHA="${COMMIT_SHA:0:7}"

          PAYLOAD=$(cat <<EOF
          {
            "content": "project-01 deploy for \`${{ github.repository }}\` @ [\`$SHORT_SHA\`]($COMMIT_URL): $LINE\\n• Web: https://web.project-01.gjirafa.dev\\n• API: https://api.project-01.gjirafa.dev\\nRun: $RUN_URL"
          }
          EOF
          )

          curl -sS -X POST "$DISCORD_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"

      - name: Skip notification
        if: env.DISCORD_WEBHOOK_URL == ''
        run: echo "DISCORD_WEBHOOK_URL secret is not configured. Skipping notification."