Deploy to VPS Staging Environment

.github/workflows/auto-cd.yml

@@ -0,0 +1,289 @@
+name: CD - Build and Deploy on VPS
+
+on:
+  push:
+    branches:
+      - prod
+      - main
+  workflow_dispatch: # Allow manual trigger
+
+env:
+  REGISTRY: docker.io
+  IMAGE_NAME: ${{ secrets.DOCKER_USERNAME }}/taskgenix-be
+
+jobs:
+  build-and-push:
+    runs-on: self-hosted
+    permissions:
+      contents: read
+      packages: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Create Firebase service account file
+        env:
+          FIREBASE_SERVICE_ACCOUNT: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
+        run: |
+          echo "$FIREBASE_SERVICE_ACCOUNT" > firebase-service-account.json
+
+          # Verify the file is valid JSON
+          if ! jq . firebase-service-account.json >/dev/null 2>&1; then
+            echo "❌ Error: firebase-service-account.json is not valid JSON"
+            cat firebase-service-account.json
+            exit 1
+          fi
+
+          echo "✅ Firebase service account file created successfully"
+          ls -lh firebase-service-account.json
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Generate image tags
+        id: tags
+        run: |
+          BRANCH_NAME=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          SHORT_SHA=$(git rev-parse --short HEAD)
+
+          # Sanitize branch name for Docker tag (replace / with -)
+          SAFE_BRANCH=$(echo "$BRANCH_NAME" | sed 's/\//-/g')
+
+          echo "branch=${SAFE_BRANCH}" >> $GITHUB_OUTPUT
+          echo "sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+          # Build tags
+          TAGS="${{ env.IMAGE_NAME }}:latest"
+          TAGS="${TAGS},${{ env.IMAGE_NAME }}:${SAFE_BRANCH}"
+          TAGS="${TAGS},${{ env.IMAGE_NAME }}:${SAFE_BRANCH}-${SHORT_SHA}"
+
+          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
+
+          echo "Generated tags:"
+          echo "$TAGS" | tr ',' '\n'
+
+      - name: Build and push Docker image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile.prod
+          # Push only on push event, PR only build
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          secret-files: |
+            firebase_service_account=./firebase-service-account.json
+
+      - name: Comment on PR with build info
+        if: github.event_name == 'pull_request'
+        uses: marocchino/sticky-pull-request-comment@v2.9.4
+        with:
+          header: build-status
+          message: |
+            ## 🐳 Docker Build Complete
+
+            **Image would be tagged as:**
+            - `${{ env.IMAGE_NAME }}:latest`
+            - `${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.branch }}`
+            - `${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.branch }}-${{ steps.tags.outputs.sha }}`
+
+            **Tag explanations:**
+            - latest - Always points to the most recent build
+            - {branch-name} - Tracks the specific branch
+            - {branch-name}-{short-sha} - Unique identifier for this exact commit
+
+            **Note:** Image is built but not pushed for pull requests.
+
+            📦 [View on Docker Hub](https://hub.docker.com/repository/docker/lcaohoanq/taskgenix-be)
+
+      - name: Image digest
+        if: github.event_name != 'pull_request'
+        run: echo ${{ steps.build.outputs.digest }}
+
+      - name: Clean up sensitive files
+        if: always()
+        run: |
+          rm -f firebase-service-account.json
+          echo "🧹 Cleaned up sensitive files"
+
+  deploy:
+    needs: build-and-push
+    runs-on: self-hosted
+    if: github.event_name != 'pull_request' && (github.ref == 'refs/heads/prod' || github.ref == 'refs/heads/main')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set environment
+        id: env
+        run: |
+          if [[ "${{ github.ref }}" == "refs/heads/prod" ]]; then
+            echo "environment=production" >> $GITHUB_OUTPUT
+            echo "compose_file=docker-compose.prod.yml" >> $GITHUB_OUTPUT
+          else
+            echo "environment=staging" >> $GITHUB_OUTPUT
+            echo "compose_file=docker-compose.dev.yml" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create .env file
+        run: |
+          cat > .env << EOF
+          Jwt__SecretKey=${{ secrets.JWT__SECRETKEY }}
+          Jwt__Issuer=${{ secrets.JWT__ISSUER }}
+          Jwt__Audience=${{ secrets.JWT__AUDIENCE }}
+          ConnectionStrings__SupabaseConnection=${{ secrets.CONNECTIONSTRINGS__SUPABASECONNECTION }}
+          Jwt__RefreshSecretKey=${{ secrets.JWT__REFRESHSECRETKEY }}
+          Auth0__InternalSyncSecret=${{ secrets.AUTH0__INTERNALSYNCSECRET }}
+          PayOS__ClientId=${{ secrets.PAYOS__CLIENTID }}
+          PayOS__ApiKey=${{ secrets.PAYOS__APIKEY }}
+          PayOS__ChecksumKey=${{ secrets.PAYOS__CHECKSUMKEY }}
+          B2Storage__ServiceUrl=${{ secrets.B2STORAGE__SERVICEURL }}
+          B2Storage__BucketName=${{ secrets.B2STORAGE__BUCKETNAME }}
+          B2Storage__AccessKeyId=${{ secrets.B2STORAGE__ACCESSKEYID }}
+          B2Storage__SecretAccessKey=${{ secrets.B2STORAGE__SECRETACCESSKEY }}
+          AI__Gemini__Summarize__APIKey=${{ secrets.AI__GEMINI__SUMMARIZE__APIKEY }}
+          AI__Gemini__TaskGen__APIKey=${{ secrets.AI__GEMINI__TASKGEN__APIKEY }}
+          CloudflareR2__AccessKeyId=${{ secrets.CLOUDFLARER2__ACCESSKEYID }}
+          CloudflareR2__SecretAccessKey=${{ secrets.CLOUDFLARER2__SECRETACCESSKEY }}
+          CloudflareR2__ServiceUrl=${{ secrets.CLOUDFLARER2__SERVICEURL }}
+          CloudflareR2__BucketName=${{ secrets.CLOUDFLARER2__BUCKETNAME }}
+          EOF
+
+      - name: Create docker-compose file
+        run: |
+          cat > docker-compose.prod.yml << 'EOF'
+          networks:
+            taskgenix_network:
+              driver: bridge
+
+          services:
+            taskgenix-server-prod:
+              container_name: taskgenix-server
+              image: lcaohoanq/taskgenix-be:latest
+              ports:
+                - "8386:5009"
+              env_file:
+                - .env
+              environment:
+                - Jwt__ExpirationInMinutes=60
+                - Jwt__RefreshExpirationInDays=182
+                - AllowedHosts=*
+                - ApplyMigrations=false
+                - "BaseURL=com.app.tgx:"
+                - AI__Gemini__Summarize__Model=gemini-2.0-flash
+                - AI__Gemini__TaskGen__Model=gemini-2.0-flash
+              volumes:
+                - /home/lcaohoanq/dulieu/taskgenix/firebase-service-account.json:/app/firebase-service-account.json:ro
+              restart: always
+              networks:
+                - taskgenix_network
+          EOF
+
+      - name: Pull latest image
+        run: |
+          echo "🔄 Pulling latest Docker image..."
+          docker pull ${{ env.IMAGE_NAME }}:latest
+
+      - name: Stop existing containers
+        run: |
+          echo "🛑 Stopping existing containers..."
+          docker compose -f docker-compose.prod.yml down || true
+
+      - name: Deploy application
+        run: |
+          echo "🚀 Deploying to ${{ steps.env.outputs.environment }} environment..."
+          docker compose -f docker-compose.prod.yml up -d --build --remove-orphans
+
+      # - name: Wait for container to be healthy
+      #   run: |
+      #     echo "⏳ Waiting for container to be healthy..."
+      #     timeout=60
+      #     elapsed=0
+
+      #     while [ $elapsed -lt $timeout ]; do
+      #       if docker ps | grep -q taskgenix-server; then
+      #         if [ "$(docker inspect --format='{{.State.Health.Status}}' taskgenix-server 2>/dev/null)" = "healthy" ]; then
+      #           echo "✅ Container is healthy!"
+      #           break
+      #         fi
+      #       fi
+
+      #       echo "Waiting... ($elapsed/$timeout seconds)"
+      #       sleep 5
+      #       elapsed=$((elapsed + 5))
+      #     done
+
+      #     if [ $elapsed -ge $timeout ]; then
+      #       echo "❌ Container failed to become healthy within $timeout seconds"
+      #       docker logs taskgenix-server --tail 50
+      #       exit 1
+      #     fi
+
+      - name: Verify deployment
+        run: |
+          echo "🔍 Verifying deployment..."
+          docker ps -a | grep taskgenix-server
+
+          echo "📋 Container logs (last 20 lines):"
+          docker logs taskgenix-server --tail 20
+
+      - name: Clean up old images
+        run: |
+          echo "🧹 Cleaning up old Docker images..."
+          docker image prune -af --filter "until=24h" || true
+
+  notify:
+    needs: [build-and-push, deploy]
+    runs-on: ubuntu-latest
+    if: always()
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Comment on PR - Success
+        if: github.event_name == 'pull_request' && needs.build-and-push.result == 'success'
+        uses: marocchino/sticky-pull-request-comment@v2.9.4
+        with:
+          header: build-result
+          message: |
+            ## ✅ Build Successful!
+
+            Your changes have been built successfully.
+
+            📦 [View on Docker Hub](https://hub.docker.com/repository/docker/lcaohoanq/taskgenix-be)
+
+      - name: Comment on PR - Failure
+        if: github.event_name == 'pull_request' && needs.build-and-push.result == 'failure'
+        uses: marocchino/sticky-pull-request-comment@v2.9.4
+        with:
+          header: build-result
+          message: |
+            ## ❌ Build Failed!
+
+            Please check the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.
+
+      - name: Notify deployment success
+        if: github.event_name == 'push' && needs.deploy.result == 'success'
+        run: |
+          echo "✅ Deployment successful!"
+          echo "Environment: ${{ needs.deploy.outputs.environment }}"
+          echo "Image: ${{ env.IMAGE_NAME }}:latest"
+          # Add notification logic here (Slack, Discord, Email, etc.)
+
+      - name: Notify deployment failure
+        if: github.event_name == 'push' && needs.deploy.result == 'failure'
+        run: |
+          echo "❌ Deployment failed!"
+          echo "Check the logs for details"
+          # Add failure notification logic here