deploy.yml

name: Production Deploy Laravel

on:
  push:
    branches: [ main ]

jobs:
  # ─────────────────────────────────────────────
  # JOB 1: Build PHP & frontend assets
  # ─────────────────────────────────────────────
  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
      # 1️⃣ Checkout
      - uses: actions/checkout@v4

      # 2️⃣ PHP setup (extensions mirror what the server must have)
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: pdo_pgsql, bcmath, gd, intl, zip, opcache
          coverage: none
          tools: composer:v2

      # 3️⃣ Composer – restore cache first, then install
      - name: Cache Composer packages
        id: composer-cache
        uses: actions/cache@v4
        with:
          path: vendor
          key: composer-${{ hashFiles('composer.lock') }}
          restore-keys: composer-

      - name: Install PHP dependencies
        run: composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction

      # 4️⃣ Node build (frontend assets)
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install Node dependencies
        run: npm ci

      - name: Build frontend
        run: npm run build

      # 5️⃣ Upload the build artefact for the deploy job
      - name: Upload build artefact
        uses: actions/upload-artifact@v4
        with:
          name: app-build
          # include-hidden-files MUST be true — public/.htaccess is a dotfile
          # and v4 defaults to false, which causes rsync --delete to wipe it
          # from the server, breaking all Laravel routes except /
          include-hidden-files: true
          path: |
            .
            !.git
            !node_modules
          retention-days: 1

  # ─────────────────────────────────────────────
  # JOB 2: Deploy to production server
  # ─────────────────────────────────────────────
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: build

    steps:
      # 1️⃣ Download the build artefact
      - name: Download build artefact
        uses: actions/download-artifact@v4
        with:
          name: app-build
          path: .

      # 2️⃣ Setup SSH
      - name: Setup SSH
        env:
          SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

      # 3️⃣ Verify SSH connection
      - name: Verify SSH connection
        run: |
          ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no \
            ${{ secrets.SERVER_USERNAME }}@${{ secrets.SERVER_HOST }} \
            "echo 'SSH connection successful'"

      # 4️⃣ Deploy files via rsync
      - name: Deploy files to server
        run: |
          ssh -i ~/.ssh/id_ed25519 ${{ secrets.SERVER_USERNAME }}@${{ secrets.SERVER_HOST }} \
            "mkdir -p /home/${{ secrets.SERVER_USERNAME }}/web/${{ secrets.PROJECT_DOMAIN }}/public_html"

          rsync -az --delete \
            -e "ssh -i ~/.ssh/id_ed25519" \
            --exclude='.git' \
            --exclude='node_modules' \
            --exclude='storage' \
            --exclude='.env' \
            ./ \
            ${{ secrets.SERVER_USERNAME }}@${{ secrets.SERVER_HOST }}:/home/${{ secrets.SERVER_USERNAME }}/web/${{ secrets.PROJECT_DOMAIN }}/public_html

          # ── Verify .htaccess was deployed (safety check) ─────────────────
          ssh -i ~/.ssh/id_ed25519 ${{ secrets.SERVER_USERNAME }}@${{ secrets.SERVER_HOST }} \
            "[ -f /home/${{ secrets.SERVER_USERNAME }}/web/${{ secrets.PROJECT_DOMAIN }}/public_html/public/.htaccess ] \
             && echo '✅ public/.htaccess present' \
             || { echo '❌ public/.htaccess MISSING — deploy artifact may have excluded dotfiles'; exit 1; }"

      # 5️⃣ Activate release on the server
      - name: Activate release
        run: |
          ssh -i ~/.ssh/id_ed25519 ${{ secrets.SERVER_USERNAME }}@${{ secrets.SERVER_HOST }} << 'EOF'

          set -e

          BASE="/home/${{ secrets.SERVER_USERNAME }}/web/${{ secrets.PROJECT_DOMAIN }}"
          FINAL="$BASE/public_html"

          cd "$FINAL"

          # ── 1. Symlink .env (kept in private/ outside public_html) ──────
          if [ -f "$BASE/private/.env" ]; then
            ENV_PATH="$BASE/private/.env"
          elif [ -f "$BASE/.env" ]; then
            echo "Migrating .env file to secure private/ folder..."
            mkdir -p "$BASE/private"
            mv "$BASE/.env" "$BASE/private/.env"
            ENV_PATH="$BASE/private/.env"
          fi

          if [ -n "$ENV_PATH" ]; then
            echo "Using environment file from: $ENV_PATH"
            ln -sfn "$ENV_PATH" "$FINAL/.env"
          else
            echo "Error: .env not found in $BASE/private/. Create it on the server first."
            exit 1
          fi

          # ── 2. Ensure storage directory structure exists ─────────────────
          if [ -L storage ]; then
            echo "Removing old storage symlink..."
            rm -f storage
          fi
          mkdir -p storage/framework/sessions
          mkdir -p storage/framework/views
          mkdir -p storage/framework/cache/data
          mkdir -p storage/logs
          mkdir -p storage/app/public
          
          # Set permissions only on specific directories to avoid "Operation not permitted" 
          # on restricted system folders like storage/app/private
          echo "Setting directory permissions..."
          chmod -R 775 storage/framework storage/logs storage/app/public bootstrap/cache || true

          # ── 3. Clear stale caches before running anything ────────────────
          php artisan config:clear  || true
          php artisan route:clear   || true
          php artisan view:clear    || true
          php artisan storage:link --force || true

          # ── 4. Run migrations ────────────────────────────────────────────
          php artisan migrate --force

          # ── 5. Seed only if no admin user exists ─────────────────────────
          ADMIN_COUNT=$(php artisan tinker --execute="echo \App\Models\Admin::where('super_admin', true)->count();" | tr -d '\r\n[:alpha:][:space:]')
          if [ "$ADMIN_COUNT" = "0" ]; then
            echo "First-time deployment: seeding database..."
            php artisan db:seed --force
          else
            echo "Database already seeded (Admins: $ADMIN_COUNT). Skipping."
          fi

          # ── 6. Re-cache for production ───────────────────────────────────
          php artisan config:cache
          php artisan route:cache  || { echo "⚠️  route:cache failed — running without route cache"; php artisan route:clear; }
          php artisan view:cache   || true

          echo "✅ Deployment complete."
          EOF