deploy.yml

name: Deploy to EC2

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: khulon/syncdoc

jobs:
  # ── Build & push image to ghcr.io ────────────────────────────────────────────
  build:
    name: Build & push image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: client/package.json

      - name: Install and build frontend
        working-directory: client
        run: npm ci && npm run build

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=sha-
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  # ── Deploy to EC2 ─────────────────────────────────────────────────────────────
  deploy:
    name: Deploy to EC2
    runs-on: ubuntu-latest
    needs: build
    environment: production

    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USER }}
          key: ${{ secrets.EC2_SSH_KEY }}
          script: |
            set -e
            cd ${{ secrets.EC2_DEPLOY_PATH }}

            # Sync to latest — use fetch+reset so force pushes never break this
            git fetch origin main
            git reset --hard origin/main

            # Log in to ghcr.io and pull new image
            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io \
              -u ${{ github.actor }} --password-stdin
            docker pull ghcr.io/khulon/syncdoc:latest

            # Remove old images no longer used by any container
            docker image prune -af

            # Restart infra services with latest config (nginx, prometheus, grafana)
            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate nginx prometheus grafana

            # Rolling restart — app2 stays up while app1 restarts, then swap
            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate app1
            sleep 15

            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate app2
            sleep 15

            # Health check — bypass nginx (which 301-redirects HTTP→HTTPS)
            # Hit app containers directly on their exposed ports
            STATUS1=$(curl -sf -o /dev/null -w "%{http_code}" http://localhost:3001/api/health || echo "000")
            STATUS2=$(curl -sf -o /dev/null -w "%{http_code}" http://localhost:3002/api/health || echo "000")
            echo "app1: HTTP $STATUS1  |  app2: HTTP $STATUS2"
            if [ "$STATUS1" != "200" ] || [ "$STATUS2" != "200" ]; then
              echo "❌ Deploy failed — showing logs"
              docker compose -f docker-compose.prod.yml logs app1 app2 --tail=50
              exit 1
            fi
            echo "✅ Deploy complete"
            echo "✅ Deploy complete"

      - name: Verify from GitHub runner
        run: |
          sleep 5
          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" \
            https://${{ secrets.DOMAIN || secrets.EC2_HOST }}/api/health || echo "000")
          echo "External health check: HTTP $STATUS"
          [ "$STATUS" = "200" ] && echo "✅ Live" || echo "⚠️  Check server (may need SSL setup)"