ci-cd.yml

name: CI/CD

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # ── CI Check Gate ──────────────────────────────────────────
  ci-checks:
    name: CI Checks (Lint & Type Check)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./frontend

    steps:
      - name: Checkout repository
        uses: actions/checkout@main
        with:
          lfs: false

      - name: Install pnpm
        uses: pnpm/action-setup@master

      - name: Setup Node.js
        uses: actions/setup-node@main
        with:
          node-version: "26.3.0"
          cache: 'pnpm'
          cache-dependency-path: './frontend/pnpm-lock.yaml'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run Format & Lint Check
        run: pnpm biome ci src/

      - name: Run Type Check
        run: pnpm tsc --noEmit

  # ── Build & Push Docker Image ───────────────────────────────
  build-and-push:
    name: Build & Push Image
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: ci-checks
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@main
        with:
          lfs: true

      - name: Lowercase repository owner
        run: echo "REPO_OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> ${GITHUB_ENV}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@master
        with:
          platforms: linux/arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@master

      - name: Log in to the Container registry
        uses: docker/login-action@master
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@master
        with:
          images: ghcr.io/${{ github.repository }}

      - name: Build and push Docker image
        uses: docker/build-push-action@master
        with:
          context: .
          file: Dockerfile.deploy
          platforms: linux/arm64
          push: true
          tags: ghcr.io/${{ env.REPO_OWNER_LC }}/peak-sight:latest
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            NEXT_PUBLIC_FULL_URL=${{ secrets.NEXT_PUBLIC_FULL_URL }}
            NEXT_PUBLIC_BACKEND_URL=${{ secrets.NEXT_PUBLIC_BACKEND_URL }}
            NEXT_PUBLIC_BASE_PATH=${{ secrets.NEXT_PUBLIC_BASE_PATH }}
            POSTGRES_DB=${{ secrets.POSTGRES_DB }}
            POSTGRES_USER=${{ secrets.POSTGRES_USER }}
            POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}
            FRONTEND_PORT=${{ secrets.FRONTEND_PORT }}
            BACKEND_PORT=${{ secrets.API_PORT }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # ── Deploy to VPS ──────────────────────────────────────────
  deploy:
    name: Deploy Image to VPS
    runs-on: ubuntu-latest
    needs: build-and-push

    steps:
      - name: Lowercase repository owner
        run: echo "REPO_OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> ${GITHUB_ENV}

      - name: Setup Tailscale
        uses: tailscale/github-action@main
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci

      - name: Pull & Run Image on VPS
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_KEY }}
          port: ${{ secrets.DEPLOY_PORT }}
          script: |
            set -e

            cd ${{ secrets.DEPLOY_TARGET }}

            IMAGE="ghcr.io/${{ env.REPO_OWNER_LC }}/peak-sight:latest"

            # Login to registry
            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
            
            # Pull the latest image
            docker pull $IMAGE
            
            # Stop existing containers
            docker stop peak-sight peak-sight-redis-exporter || true
            docker rm peak-sight peak-sight-redis-exporter || true

            # Networking
            docker network create peak-sight-net || true

            # Env Setup
            FE_PORT=${{ secrets.FRONTEND_PORT }}
            API_PORT=${{ secrets.API_PORT }}
            
            # Run Application
            docker run -d --name peak-sight \
              --restart unless-stopped \
              --network peak-sight-net \
              --env-file .env \
              -e PORT=${FE_PORT:-3400} \
              -e API_PORT=${API_PORT:-8200} \
              -e API_BASE_PATH="${{ secrets.API_BASE_PATH }}" \
              -p 127.0.0.1:${FE_PORT:-3400}:${FE_PORT:-3400} \
              -p 127.0.0.1:${API_PORT:-8200}:${API_PORT:-8200} \
              $IMAGE

            # Run Redis Exporter
            docker run -d --name peak-sight-redis-exporter \
              --restart unless-stopped \
              --network peak-sight-net \
              -p 127.0.0.1:9121:9121 \
              -e REDIS_ADDR=redis://peak-sight:6379 \
              bitnami/redis-exporter:latest

            # Post-deployment: Initialize DB
            echo "Waiting for DB to be ready..."
            ATTEMPTS=0
            MAX_ATTEMPTS=60
            until docker exec peak-sight pg_isready -U postgres || [ $ATTEMPTS -eq $MAX_ATTEMPTS ]; do
              ATTEMPTS=$((ATTEMPTS + 1))
              sleep 2
            done

            if [ $ATTEMPTS -eq $MAX_ATTEMPTS ]; then
              echo "Error: PostgreSQL is not responding."
              exit 1
            fi

            echo "Setting up DB and importing data..."
            PG_USER="${{ secrets.POSTGRES_USER }}"
            PG_DB="${{ secrets.POSTGRES_DB }}"
            PG_PASS="${{ secrets.POSTGRES_PASSWORD }}"

            docker exec peak-sight su postgres -c "psql -tc \"SELECT 1 FROM pg_user WHERE usename = '$PG_USER'\" | grep -q 1 || psql -c \"CREATE USER $PG_USER WITH PASSWORD '$PG_PASS';\""
            docker exec peak-sight su postgres -c "psql -tc \"SELECT 1 FROM pg_database WHERE datname = '$PG_DB'\" | grep -q 1 || psql -c \"CREATE DATABASE $PG_DB OWNER $PG_USER;\""
            docker exec peak-sight su postgres -c "psql -d $PG_DB -c \"CREATE EXTENSION IF NOT EXISTS postgis;\""

            # Run Migrations (Synchronously as it is required for app)
            docker exec -w /app/backend peak-sight uv run python manage.py migrate

            # Run Data Imports in the background using screen
            echo "Starting data imports in the background (screen)..."
            docker exec -w /app/backend peak-sight screen -d -m bash -c "
              echo \"--- Start Import: \$(date) ---\" >> import.log;
              if [ -f data/yamareco.json ]; then 
                echo 'Mountain data import started...' >> import.log;
                uv run python commons/import_mountains.py >> import.log 2>&1;
              fi;
              if ls data/paths_merged/*.json 1> /dev/null 2>&1; then 
                echo 'Path data import started...' >> import.log;
                uv run python commons/import_paths.py >> import.log 2>&1;
              fi;
              echo \"--- End Import: \$(date) ---\" >> import.log;
            "
            echo "Data import has been started in a background screen session."
            echo "You can check progress with: docker exec peak-sight tail -f /app/backend/import.log"

            docker logout ghcr.io
            echo "Deployment finished!"