deploy.yml

# 构建镜像推送到 GHCR，并同步到阿里云个人版 ACR（服务器从 ACR 拉取更快）
# 需在 Settings -> Secrets 配置：
#   SSH_HOST, SSH_USERNAME, SSH_PASSWORD 或 SSH_KEY, SSH_PORT, PROJECT_PATH
#   ALIYUN_ACR_REGISTRY、ALIYUN_ACR_NAMESPACE、ALIYUN_ACR_USERNAME、ALIYUN_ACR_PASSWORD（用 ACR 时必填）
#   JAKARTA_SSH_HOST, JAKARTA_SSH_USERNAME, JAKARTA_SSH_PASSWORD 或 JAKARTA_SSH_KEY,
#   JAKARTA_SSH_PORT, JAKARTA_PROJECT_PATH, JAKARTA_API_LOCAL（可选，仅部署海外前台）
name: Build & Deploy

on:
  push:
    branches:
      - master

env:
  GHCR_PREFIX: ghcr.io/adkcodexd
  ACR_REG: ${{ secrets.ALIYUN_ACR_REGISTRY }}
  ACR_NS: ${{ secrets.ALIYUN_ACR_NAMESPACE }}
  ACR_USER: ${{ secrets.ALIYUN_ACR_USERNAME }}
  ACR_PASS: ${{ secrets.ALIYUN_ACR_PASSWORD }}
  MAIN_DEPLOY_ENABLED: ${{ secrets.SSH_HOST != '' && secrets.SSH_USERNAME != '' && secrets.PROJECT_PATH != '' && (secrets.SSH_PASSWORD != '' || secrets.SSH_KEY != '') }}
  JAKARTA_DEPLOY_ENABLED: ${{ secrets.JAKARTA_SSH_HOST != '' && secrets.JAKARTA_SSH_USERNAME != '' && secrets.JAKARTA_PROJECT_PATH != '' && (secrets.JAKARTA_SSH_PASSWORD != '' || secrets.JAKARTA_SSH_KEY != '') }}

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push backend
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/backend/Dockerfile
          push: true
          tags: ${{ env.GHCR_PREFIX }}/mmgc-backend:latest

      - name: Build & push frontend
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/frontend/Dockerfile
          push: true
          tags: ${{ env.GHCR_PREFIX }}/mmgc-frontend:latest

      - name: Build & push admin (old)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/MMGCBACK/Dockerfile
          push: true
          tags: ${{ env.GHCR_PREFIX }}/mmgc-admin:latest

      - name: Build & push admin-next (new)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/admin-next/Dockerfile
          push: true
          tags: ${{ env.GHCR_PREFIX }}/mmgc-admin-next:latest

      - name: Push to Aliyun ACR (personal)
        run: |
          if [ -z "$ACR_USER" ] || [ -z "$ACR_REG" ]; then
            echo "Skip: ALIYUN_ACR_* Secrets not set."
            exit 0
          fi
          echo "$ACR_PASS" | docker login "$ACR_REG" -u "$ACR_USER" --password-stdin
          for img in mmgc-backend mmgc-frontend mmgc-admin mmgc-admin-next; do
            docker pull ${{ env.GHCR_PREFIX }}/$img:latest
            docker tag ${{ env.GHCR_PREFIX }}/$img:latest "$ACR_REG/$ACR_NS/$img:latest"
            docker push "$ACR_REG/$ACR_NS/$img:latest"
          done

      - name: Deploy via SSH
        if: ${{ env.MAIN_DEPLOY_ENABLED == 'true' }}
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          password: ${{ secrets.SSH_PASSWORD }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.SSH_PORT }}
          command_timeout: 30m
          script: |
            if [ -n "${{ secrets.GHCR_TOKEN }}" ]; then
              echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USERNAME || github.actor }}" --password-stdin
            fi
            if [ -n "${{ secrets.ALIYUN_ACR_PASSWORD }}" ] && [ -n "${{ secrets.ALIYUN_ACR_REGISTRY }}" ]; then
              echo "${{ secrets.ALIYUN_ACR_PASSWORD }}" | docker login "${{ secrets.ALIYUN_ACR_REGISTRY }}" -u "${{ secrets.ALIYUN_ACR_USERNAME }}" --password-stdin
            fi
            if [ ! -d "${{ secrets.PROJECT_PATH }}" ]; then
              git clone https://github.com/${{ github.repository }}.git ${{ secrets.PROJECT_PATH }}
            fi
            cd ${{ secrets.PROJECT_PATH }}
            git pull origin master
            docker compose -f docker-compose.yml -f docker-compose.production.yml pull
            docker compose -f docker-compose.yml -f docker-compose.production.yml up -d
            docker image prune -f

      - name: Skip main SSH deploy
        if: ${{ env.MAIN_DEPLOY_ENABLED != 'true' }}
        run: |
          echo "Skip: main SSH deployment secrets are not fully configured."

      - name: Deploy Jakarta frontend via SSH
        if: ${{ env.JAKARTA_DEPLOY_ENABLED == 'true' }}
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.JAKARTA_SSH_HOST }}
          username: ${{ secrets.JAKARTA_SSH_USERNAME }}
          password: ${{ secrets.JAKARTA_SSH_PASSWORD }}
          key: ${{ secrets.JAKARTA_SSH_KEY }}
          port: ${{ secrets.JAKARTA_SSH_PORT }}
          command_timeout: 30m
          script: |
            if [ -n "${{ secrets.GHCR_TOKEN }}" ]; then
              echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USERNAME || github.actor }}" --password-stdin
            fi
            if [ -n "${{ secrets.ALIYUN_ACR_PASSWORD }}" ] && [ -n "${{ secrets.ALIYUN_ACR_REGISTRY }}" ]; then
              echo "${{ secrets.ALIYUN_ACR_PASSWORD }}" | docker login "${{ secrets.ALIYUN_ACR_REGISTRY }}" -u "${{ secrets.ALIYUN_ACR_USERNAME }}" --password-stdin
            fi
            if [ ! -d "${{ secrets.JAKARTA_PROJECT_PATH }}" ]; then
              git clone https://github.com/${{ github.repository }}.git ${{ secrets.JAKARTA_PROJECT_PATH }}
            fi
            cd ${{ secrets.JAKARTA_PROJECT_PATH }}
            git pull origin master
            mkdir -p env
            if [ -z "${{ secrets.JAKARTA_API_LOCAL }}" ]; then
              export JAKARTA_API_LOCAL="https://mirai-mad.com"
            else
              export JAKARTA_API_LOCAL="${{ secrets.JAKARTA_API_LOCAL }}"
            fi
            if [ -z "${{ secrets.JAKARTA_SITE_URL }}" ]; then
              export JAKARTA_SITE_URL="$JAKARTA_API_LOCAL"
            else
              export JAKARTA_SITE_URL="${{ secrets.JAKARTA_SITE_URL }}"
            fi
            if [ ! -f env/frontend.env.production ]; then
              cat > env/frontend.env.production <<EOF
            NUXT_PUBLIC_API_BASE=$JAKARTA_SITE_URL
            NUXT_PUBLIC_API_PREFIX=/mmgcApi
            NUXT_PUBLIC_API_LOCAL=$JAKARTA_API_LOCAL
            EOF
            fi
            cat > docker-compose.jakarta.yml <<'EOF'
            services:
              frontend:
                environment:
                  NUXT_PUBLIC_API_LOCAL: ${JAKARTA_API_LOCAL:-https://mirai-mad.com}
            EOF
            docker compose -f docker-compose.yml -f docker-compose.jakarta.yml pull frontend
            docker compose -f docker-compose.yml -f docker-compose.jakarta.yml up -d --no-deps frontend
            docker image prune -f

      - name: Skip Jakarta frontend deploy
        if: ${{ env.JAKARTA_DEPLOY_ENABLED != 'true' }}
        run: |
          echo "Skip: Jakarta frontend deployment secrets are not fully configured."