deploy.yml

name: deploy

on:
  push: { branches: [main] }
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-south-1
  CLUSTER: docanalytics-cluster
  API_REPO: docanalytics-api
  WEB_REPO: docanalytics-web
  MIG_REPO: docanalytics-migrations

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build & push API image
        env:
          REG: ${{ steps.ecr.outputs.registry }}
        run: |
          docker build -t $REG/$API_REPO:${{ github.sha }} -f DocAnalytics.Api/Dockerfile .
          docker push  $REG/$API_REPO:${{ github.sha }}

      - name: Build & push Web image
        env:
          REG: ${{ steps.ecr.outputs.registry }}
        run: |
          docker build -t $REG/$WEB_REPO:${{ github.sha }} -f docanalytics-web/Dockerfile docanalytics-web
          docker push  $REG/$WEB_REPO:${{ github.sha }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      # ── Build migrations as a self-contained bundle, ship as an image ──
      - name: Build migration bundle image & push
        env:
          REG: ${{ steps.ecr.outputs.registry }}
        run: |
          dotnet restore DocAnalytics.slnx
          dotnet tool install --global dotnet-ef
          dotnet ef migrations bundle --self-contained -r linux-x64 \
            --project DocAnalytics.Data --startup-project DocAnalytics.Api -o efbundle --force
          docker build -t $REG/$MIG_REPO:${{ github.sha }} -f deploy/migrate.Dockerfile .
          docker push  $REG/$MIG_REPO:${{ github.sha }}

      # ── GATED migration: run inside the VPC so it CAN reach RDS ──
      - name: Register + run migration task (gated)
        env:
          REG: ${{ steps.ecr.outputs.registry }}
        run: |
          sed "s|PLACEHOLDER_WILL_BE_REPLACED_BY_WORKFLOW|$REG/$MIG_REPO:${{ github.sha }}|" \
            deploy/migrate-task-def.json > mig.json
          aws ecs register-task-definition --cli-input-json file://mig.json
          TASK_ARN=$(aws ecs run-task --cluster $CLUSTER --launch-type FARGATE \
            --task-definition docanalytics-migrate \
            --network-configuration "awsvpcConfiguration={subnets=[${{ secrets.PRIV_SUBNETS }}],securityGroups=[${{ secrets.TASK_SG }}],assignPublicIp=ENABLED}" \
            --query 'tasks[0].taskArn' --output text)
          echo "task: $TASK_ARN"
          aws ecs wait tasks-stopped --cluster $CLUSTER --tasks $TASK_ARN
          CODE=$(aws ecs describe-tasks --cluster $CLUSTER --tasks $TASK_ARN \
            --query 'tasks[0].containers[0].exitCode' --output text)
          echo "migration exit code = $CODE"
          [ "$CODE" = "0" ] || { echo "❌ migration failed — aborting deploy"; exit 1; }

      # ── Deploy API (inject SHA image into the task def, then deploy) ──
      - name: Render API task def
        id: render-api
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: deploy/api-task-def.json
          container-name: api
          image: ${{ steps.ecr.outputs.registry }}/docanalytics-api:${{ github.sha }}
      - name: Deploy API service
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.render-api.outputs.task-definition }}
          service: docanalytics-api-svc
          cluster: docanalytics-cluster
          wait-for-service-stability: true

      # ── Deploy Web ──
      - name: Render Web task def
        id: render-web
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: deploy/web-task-def.json
          container-name: web
          image: ${{ steps.ecr.outputs.registry }}/docanalytics-web:${{ github.sha }}
      - name: Deploy Web service
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.render-web.outputs.task-definition }}
          service: docanalytics-web-svc
          cluster: docanalytics-cluster
          wait-for-service-stability: true

      - name: Health smoke test
        env:
          PUBLIC_URL: ${{ secrets.PUBLIC_URL }}
        run: |
          BASE="$(printf '%s' "$PUBLIC_URL" | tr -d '[:space:]')"   # strip any stray whitespace/newlines
          for i in $(seq 1 12); do
            if curl -fsSL "$BASE/api/v1/health" | grep -q '"db":"connected"'; then
              echo "✅ healthy"; exit 0
            fi
            echo "waiting... ($i)"; sleep 15
          done
          echo "❌ health check failed"; exit 1