deploy.yml

name: Deploy

on:
  workflow_dispatch:

permissions: {}

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  # ────────────────────────────────────────────────────────────────────────────
  # Job 1: Deploy Supabase (Migrations)
  # ────────────────────────────────────────────────────────────────────────────
  deploy-supabase:
    name: Deploy Supabase
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID || '' }}
      INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET || '' }}

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Fetch CI secrets from Infisical
        if: env.INFISICAL_CLIENT_ID != '' && env.INFISICAL_CLIENT_SECRET != ''
        uses: infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995
        with:
          client-id: ${{ env.INFISICAL_CLIENT_ID }}
          client-secret: ${{ env.INFISICAL_CLIENT_SECRET }}
          project-slug: ${{ secrets.INFISICAL_PROJECT_SLUG || secrets.INFISICAL_PROJECT_ID }}
          env-slug: "prod"
          secret-path: "/ci"
        continue-on-error: true

      - name: Setup Supabase CLI
        uses: supabase/setup-cli@df56b21da46c98abb12a9804e4fb1f657773e333
        with:
          version: 2.98.2

      - name: Link Project
        env:
          SUPABASE_PROJECT_ID: ${{ env.SUPABASE_PROJECT_ID || secrets.SUPABASE_PROJECT_ID }}
        run: supabase link --project-ref $SUPABASE_PROJECT_ID

      - name: Deploy Database Changes (Migrations)
        env:
          SUPABASE_ACCESS_TOKEN: ${{ env.SUPABASE_ACCESS_TOKEN || secrets.SUPABASE_ACCESS_TOKEN }}
          SUPABASE_DB_PASSWORD: ${{ env.SUPABASE_DB_PASSWORD || secrets.SUPABASE_DB_PASSWORD }}
          SUPABASE_PROJECT_ID: ${{ env.SUPABASE_PROJECT_ID || secrets.SUPABASE_PROJECT_ID }}
        run: supabase db push

  # ────────────────────────────────────────────────────────────────────────────
  # Job 2: Deploy Proxies (Cloudflare Workers & AWS Lambdas)
  # ────────────────────────────────────────────────────────────────────────────
  deploy-proxy:
    name: Deploy Proxy
    needs: deploy-supabase
    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID || '' }}
      INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET || '' }}

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: "24.14.1"

      - name: Fetch build-time variables from Infisical (Unmasked)
        if: env.INFISICAL_CLIENT_ID != '' && env.INFISICAL_CLIENT_SECRET != ''
        env:
          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
          INFISICAL_PROJECT_SLUG: ${{ secrets.INFISICAL_PROJECT_SLUG || secrets.INFISICAL_PROJECT_ID }}
          INFISICAL_ENV_SLUG: "prod"
          INFISICAL_SECRET_PATH: "/build-time"
        run: node scripts/fetch-build-time-vars.js
        continue-on-error: true

      - name: Fetch CI secrets from Infisical
        if: env.INFISICAL_CLIENT_ID != '' && env.INFISICAL_CLIENT_SECRET != ''
        uses: infisical/secrets-action@77ab1f4ccd183a543cb5b42435fbd181189f4995
        with:
          client-id: ${{ env.INFISICAL_CLIENT_ID }}
          client-secret: ${{ env.INFISICAL_CLIENT_SECRET }}
          project-slug: ${{ secrets.INFISICAL_PROJECT_SLUG || secrets.INFISICAL_PROJECT_ID }}
          env-slug: "prod"
          secret-path: "/ci"
        continue-on-error: true

      # ── Cloudflare Worker Egress Proxy ──
      - name: Validate Cloudflare deploy secrets
        id: validate-cf
        env:
          CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.CLOUDFLARE_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
          CF_WORKER_NAME: ${{ env.CF_WORKER_NAME || vars.CF_WORKER_NAME }}
          NEXT_PUBLIC_BACKEND_URL: ${{ env.NEXT_PUBLIC_BACKEND_URL || vars.NEXT_PUBLIC_BACKEND_URL }}
          CF_PROXY_SECRET: ${{ env.CF_PROXY_SECRET || secrets.CF_PROXY_SECRET }}
        run: |
          if [ -z "${CLOUDFLARE_API_TOKEN}" ] || [ -z "${CLOUDFLARE_ACCOUNT_ID}" ] || [ -z "${CF_WORKER_NAME}" ] || [ -z "${NEXT_PUBLIC_BACKEND_URL}" ] || [ -z "${CF_PROXY_SECRET}" ]; then
            echo "::warning::Skipping Cloudflare deploy because required credentials/vars are missing."
            echo "Required: secrets.CLOUDFLARE_API_TOKEN, secrets.CLOUDFLARE_ACCOUNT_ID, secrets.CF_PROXY_SECRET, vars.CF_WORKER_NAME, vars.NEXT_PUBLIC_BACKEND_URL"
            echo "skip=true" >> "${GITHUB_OUTPUT}"
          else
            echo "skip=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Install Wrangler
        if: steps.validate-cf.outputs.skip != 'true'
        run: npm ci --prefix workers

      - name: Update Cloudflare Worker secret (PROXY_SECRET)
        if: steps.validate-cf.outputs.skip != 'true'
        env:
          CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.CLOUDFLARE_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
          CF_WORKER_NAME: ${{ env.CF_WORKER_NAME || vars.CF_WORKER_NAME }}
          CF_PROXY_SECRET: ${{ env.CF_PROXY_SECRET || secrets.CF_PROXY_SECRET }}
        run: |
          set -euo pipefail
          printf "%s" "${CF_PROXY_SECRET}" | ./workers/node_modules/.bin/wrangler secret put PROXY_SECRET --name "${CF_WORKER_NAME}"

      - name: Deploy Cloudflare Worker
        if: steps.validate-cf.outputs.skip != 'true'
        env:
          CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.CLOUDFLARE_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
          CF_WORKER_NAME: ${{ env.CF_WORKER_NAME || vars.CF_WORKER_NAME }}
          NEXT_PUBLIC_BACKEND_URL: ${{ env.NEXT_PUBLIC_BACKEND_URL || vars.NEXT_PUBLIC_BACKEND_URL }}
        run: |
          set -euo pipefail
          COMPAT_DATE=$(TZ=UTC git log -1 --format=%cd --date=format-local:'%Y-%m-%d' "${{ github.sha }}")
          ./workers/node_modules/.bin/wrangler deploy workers/ezygo-proxy/index.js \
            --name "${CF_WORKER_NAME}" \
            --var "EZYGO_API_URL:${NEXT_PUBLIC_BACKEND_URL}" \
            --compatibility-date "${COMPAT_DATE}"

      # ── Supabase CF Worker Proxy ──
      - name: Validate Supabase Cloudflare deploy secrets
        id: validate-supabase-cf
        env:
          CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.CLOUDFLARE_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
          CF_SUPABASE_PROXY_WORKER_NAME: ${{ env.CF_SUPABASE_PROXY_WORKER_NAME || vars.CF_SUPABASE_PROXY_WORKER_NAME }}
          NEXT_PUBLIC_SUPABASE_URL: ${{ env.NEXT_PUBLIC_SUPABASE_URL || vars.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_APP_DOMAIN: ${{ env.NEXT_PUBLIC_APP_DOMAIN || vars.NEXT_PUBLIC_APP_DOMAIN }}
        run: |
          if [ -z "${CLOUDFLARE_API_TOKEN}" ] || [ -z "${CLOUDFLARE_ACCOUNT_ID}" ] || [ -z "${CF_SUPABASE_PROXY_WORKER_NAME}" ] || [ -z "${NEXT_PUBLIC_SUPABASE_URL}" ] || [ -z "${NEXT_PUBLIC_APP_DOMAIN}" ]; then
            echo "::warning::Skipping Supabase CF Worker deploy because required credentials/vars are missing."
            echo "Required: secrets.CLOUDFLARE_API_TOKEN, secrets.CLOUDFLARE_ACCOUNT_ID, vars.CF_SUPABASE_PROXY_WORKER_NAME, vars.NEXT_PUBLIC_SUPABASE_URL, vars.NEXT_PUBLIC_APP_DOMAIN"
            echo "skip=true" >> "${GITHUB_OUTPUT}"
          else
            echo "skip=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Install Wrangler (Supabase CF Worker)
        if: steps.validate-supabase-cf.outputs.skip != 'true' && steps.validate-cf.outputs.skip == 'true'
        run: npm ci --prefix workers

      - name: Deploy Supabase CF Worker
        if: steps.validate-supabase-cf.outputs.skip != 'true'
        env:
          CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ env.CLOUDFLARE_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
          CF_SUPABASE_PROXY_WORKER_NAME: ${{ env.CF_SUPABASE_PROXY_WORKER_NAME || vars.CF_SUPABASE_PROXY_WORKER_NAME }}
          NEXT_PUBLIC_SUPABASE_URL: ${{ env.NEXT_PUBLIC_SUPABASE_URL || vars.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_APP_DOMAIN: ${{ env.NEXT_PUBLIC_APP_DOMAIN || vars.NEXT_PUBLIC_APP_DOMAIN }}
        run: |
          set -euo pipefail
          COMPAT_DATE=$(TZ=UTC git log -1 --format=%cd --date=format-local:'%Y-%m-%d' "${{ github.sha }}")
          ./workers/node_modules/.bin/wrangler deploy workers/supabase-proxy/index.js \
            --name "${CF_SUPABASE_PROXY_WORKER_NAME}" \
            --var "SUPABASE_URL:${NEXT_PUBLIC_SUPABASE_URL}" \
            --var "ALLOWED_ORIGIN:https://${NEXT_PUBLIC_APP_DOMAIN}" \
            --compatibility-date "${COMPAT_DATE}"

      # ── AWS Lambda Proxy ──
      - name: Validate AWS deploy secrets
        id: validate-aws
        env:
          AWS_REGION: ${{ env.AWS_REGION || vars.AWS_REGION }}
          AWS_LAMBDA_FUNCTION_NAME: ${{ env.AWS_LAMBDA_FUNCTION_NAME || vars.AWS_LAMBDA_FUNCTION_NAME }}
          NEXT_PUBLIC_BACKEND_URL: ${{ env.NEXT_PUBLIC_BACKEND_URL || vars.NEXT_PUBLIC_BACKEND_URL }}
          AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_SECONDARY_SECRET: ${{ env.AWS_SECONDARY_SECRET || secrets.AWS_SECONDARY_SECRET }}
        run: |
          if [ -z "${AWS_REGION}" ] || [ -z "${AWS_LAMBDA_FUNCTION_NAME}" ] || [ -z "${NEXT_PUBLIC_BACKEND_URL}" ] || [ -z "${AWS_ACCESS_KEY_ID}" ] || [ -z "${AWS_SECRET_ACCESS_KEY}" ] || [ -z "${AWS_SECONDARY_SECRET}" ]; then
            echo "::warning::Skipping AWS deploy because required credentials/vars are missing."
            echo "Required: vars.AWS_REGION, vars.AWS_LAMBDA_FUNCTION_NAME, vars.NEXT_PUBLIC_BACKEND_URL, secrets.AWS_ACCESS_KEY_ID, secrets.AWS_SECRET_ACCESS_KEY, secrets.AWS_SECONDARY_SECRET"
            echo "skip=true" >> "${GITHUB_OUTPUT}"
          else
            echo "skip=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Configure AWS credentials
        if: steps.validate-aws.outputs.skip != 'true'
        uses: aws-actions/configure-aws-credentials@713aaabfecea015b1ad8d37dc2b819ee41c00eb0
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION || vars.AWS_REGION }}

      - name: Update Lambda environment variables
        if: steps.validate-aws.outputs.skip != 'true'
        env:
          AWS_LAMBDA_FUNCTION_NAME: ${{ env.AWS_LAMBDA_FUNCTION_NAME || vars.AWS_LAMBDA_FUNCTION_NAME }}
          NEXT_PUBLIC_BACKEND_URL: ${{ env.NEXT_PUBLIC_BACKEND_URL || vars.NEXT_PUBLIC_BACKEND_URL }}
          AWS_SECONDARY_SECRET: ${{ env.AWS_SECONDARY_SECRET || secrets.AWS_SECONDARY_SECRET }}
        run: |
          set -euo pipefail

          CURRENT_VARS_JSON=$(aws lambda get-function-configuration \
            --function-name "${AWS_LAMBDA_FUNCTION_NAME}" \
            --query 'Environment.Variables' \
            --output json)

          MERGED_VARS_JSON=$(jq -c \
            --arg upstream "${NEXT_PUBLIC_BACKEND_URL}" \
            --arg secret "${AWS_SECONDARY_SECRET}" \
            '. // {} | .EZYGO_API_URL = $upstream | .PROXY_SECRET = $secret | { Variables: . }' \
            <<< "${CURRENT_VARS_JSON}")

          aws lambda update-function-configuration \
            --function-name "${AWS_LAMBDA_FUNCTION_NAME}" \
            --environment "${MERGED_VARS_JSON}"

          aws lambda wait function-updated --function-name "${AWS_LAMBDA_FUNCTION_NAME}"

      - name: Package Lambda source
        if: steps.validate-aws.outputs.skip != 'true'
        run: |
          set -euo pipefail
          cd workers/ezygo-proxy-aws
          zip -q -r "${GITHUB_WORKSPACE}/ezygo-proxy-aws.zip" index.mjs

      - name: Deploy Lambda function code
        if: steps.validate-aws.outputs.skip != 'true'
        env:
          AWS_LAMBDA_FUNCTION_NAME: ${{ env.AWS_LAMBDA_FUNCTION_NAME || vars.AWS_LAMBDA_FUNCTION_NAME }}
        run: |
          set -euo pipefail

          aws lambda update-function-code \
            --function-name "${AWS_LAMBDA_FUNCTION_NAME}" \
            --zip-file "fileb://${GITHUB_WORKSPACE}/ezygo-proxy-aws.zip" \
            --publish

      # ── Supabase AWS Lambda Proxy ──
      - name: Validate Supabase AWS deploy secrets
        id: validate-supabase-aws
        env:
          AWS_REGION: ${{ env.AWS_REGION || vars.AWS_REGION }}
          AWS_SUPABASE_LAMBDA_FUNCTION_NAME: ${{ env.AWS_SUPABASE_LAMBDA_FUNCTION_NAME || vars.AWS_SUPABASE_LAMBDA_FUNCTION_NAME }}
          NEXT_PUBLIC_SUPABASE_URL: ${{ env.NEXT_PUBLIC_SUPABASE_URL || vars.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_APP_DOMAIN: ${{ env.NEXT_PUBLIC_APP_DOMAIN || vars.NEXT_PUBLIC_APP_DOMAIN }}
          AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
        run: |
          if [ -z "${AWS_REGION}" ] || [ -z "${AWS_SUPABASE_LAMBDA_FUNCTION_NAME}" ] || [ -z "${NEXT_PUBLIC_SUPABASE_URL}" ] || [ -z "${NEXT_PUBLIC_APP_DOMAIN}" ] || [ -z "${AWS_ACCESS_KEY_ID}" ] || [ -z "${AWS_SECRET_ACCESS_KEY}" ]; then
            echo "::warning::Skipping Supabase AWS Lambda deploy because required credentials/vars are missing."
            echo "Required: vars.AWS_REGION, vars.AWS_SUPABASE_LAMBDA_FUNCTION_NAME, vars.NEXT_PUBLIC_SUPABASE_URL, vars.NEXT_PUBLIC_APP_DOMAIN, secrets.AWS_ACCESS_KEY_ID, secrets.AWS_SECRET_ACCESS_KEY"
            echo "skip=true" >> "${GITHUB_OUTPUT}"
          else
            echo "skip=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Configure AWS credentials (Supabase AWS Lambda)
        if: steps.validate-supabase-aws.outputs.skip != 'true' && steps.validate-aws.outputs.skip == 'true'
        uses: aws-actions/configure-aws-credentials@713aaabfecea015b1ad8d37dc2b819ee41c00eb0
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION || vars.AWS_REGION }}

      - name: Update Lambda environment variables (Supabase AWS Lambda)
        if: steps.validate-supabase-aws.outputs.skip != 'true'
        env:
          AWS_SUPABASE_LAMBDA_FUNCTION_NAME: ${{ env.AWS_SUPABASE_LAMBDA_FUNCTION_NAME || vars.AWS_SUPABASE_LAMBDA_FUNCTION_NAME }}
          NEXT_PUBLIC_SUPABASE_URL: ${{ env.NEXT_PUBLIC_SUPABASE_URL || vars.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_APP_DOMAIN: ${{ env.NEXT_PUBLIC_APP_DOMAIN || vars.NEXT_PUBLIC_APP_DOMAIN }}
        run: |
          set -euo pipefail

          CURRENT_VARS_JSON=$(aws lambda get-function-configuration \
            --function-name "${AWS_SUPABASE_LAMBDA_FUNCTION_NAME}" \
            --query 'Environment.Variables' \
            --output json)

          MERGED_VARS_JSON=$(jq -c \
            --arg supabase_url "${NEXT_PUBLIC_SUPABASE_URL}" \
            --arg allowed_origin "https://${NEXT_PUBLIC_APP_DOMAIN}" \
            '. // {} | .SUPABASE_URL = $supabase_url | .ALLOWED_ORIGIN = $allowed_origin | { Variables: . }' \
            <<< "${CURRENT_VARS_JSON}")

          aws lambda update-function-configuration \
            --function-name "${AWS_SUPABASE_LAMBDA_FUNCTION_NAME}" \
            --environment "${MERGED_VARS_JSON}"

          aws lambda wait function-updated --function-name "${AWS_SUPABASE_LAMBDA_FUNCTION_NAME}"

      - name: Package Lambda source (Supabase AWS Lambda)
        if: steps.validate-supabase-aws.outputs.skip != 'true'
        run: |
          set -euo pipefail
          cd workers/supabase-proxy-aws
          zip -q -r "${GITHUB_WORKSPACE}/supabase-proxy-aws.zip" index.mjs

      - name: Deploy Lambda function code (Supabase AWS Lambda)
        if: steps.validate-supabase-aws.outputs.skip != 'true'
        env:
          AWS_SUPABASE_LAMBDA_FUNCTION_NAME: ${{ env.AWS_SUPABASE_LAMBDA_FUNCTION_NAME || vars.AWS_SUPABASE_LAMBDA_FUNCTION_NAME }}
        run: |
          set -euo pipefail

          aws lambda update-function-code \
            --function-name "${AWS_SUPABASE_LAMBDA_FUNCTION_NAME}" \
            --zip-file "fileb://${GITHUB_WORKSPACE}/supabase-proxy-aws.zip" \
            --publish

  # ────────────────────────────────────────────────────────────────────────────
  # Job 3: Deploy to Production (Coolify Trigger)
  # ────────────────────────────────────────────────────────────────────────────
  deploy-prod:
    name: Deploy Production
    needs: deploy-proxy
    runs-on: ubuntu-latest
    permissions: {}

    steps:
      - name: Trigger Coolify deployment
        env:
          COOLIFY_BASE_URL: ${{ secrets.COOLIFY_BASE_URL }}
          COOLIFY_APP_ID: ${{ secrets.COOLIFY_APP_ID }}
          COOLIFY_API_TOKEN: ${{ secrets.COOLIFY_API_TOKEN }}
        run: |
          set -euo pipefail

          # Validate required Coolify configuration
          : "${COOLIFY_BASE_URL:?COOLIFY_BASE_URL secret is required}"
          : "${COOLIFY_APP_ID:?COOLIFY_APP_ID secret is required}"
          : "${COOLIFY_API_TOKEN:?COOLIFY_API_TOKEN secret is required}"

          [ -n "$COOLIFY_API_TOKEN" ] && echo "::add-mask::$COOLIFY_API_TOKEN"
          [ -n "$COOLIFY_BASE_URL" ] && echo "::add-mask::$COOLIFY_BASE_URL"
          [ -n "$COOLIFY_APP_ID" ] && echo "::add-mask::$COOLIFY_APP_ID"

          VERSION="${{ env.NEXT_PUBLIC_APP_VERSION || vars.NEXT_PUBLIC_APP_VERSION || 'latest' }}"
          echo "Deploying version ${VERSION} to Coolify"
          echo "Note: Ensure Coolify is configured to pull the versioned tag (e.g., ${VERSION})"

          curl --fail-with-body --silent --show-error \
            "$COOLIFY_BASE_URL/api/v1/deploy?uuid=$COOLIFY_APP_ID" \
            -H "Authorization: Bearer $COOLIFY_API_TOKEN"

          echo "✓ Deployment triggered successfully"