deploy.yml

name: Deploy to Production

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        default: 'production'
        type: choice
        options:
          - production

env:
  DEPLOY_PATH: /opt/codegen_orchestrator

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Write .env to server
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cat > ${{ env.DEPLOY_PATH }}/.env << 'ENVEOF'
            # Database
            POSTGRES_DB=${{ secrets.POSTGRES_DB }}
            POSTGRES_USER=${{ secrets.POSTGRES_USER }}
            POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}

            # LLM
            ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
            OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
            OPEN_ROUTER_KEY=${{ secrets.OPEN_ROUTER_KEY }}
            PO_LLM_MODEL=${{ secrets.PO_LLM_MODEL }}
            PO_LLM_BASE_URL=${{ secrets.PO_LLM_BASE_URL }}
            PO_LLM_API_KEY=${{ secrets.PO_LLM_API_KEY }}

            # Summarization
            SUMMARIZATION_MODEL=${{ secrets.SUMMARIZATION_MODEL }}
            SUMMARIZATION_MAX_TOKENS=${{ secrets.SUMMARIZATION_MAX_TOKENS }}
            SUMMARIZATION_TRIGGER_TOKENS=${{ secrets.SUMMARIZATION_TRIGGER_TOKENS }}
            SUMMARIZATION_MAX_SUMMARY_TOKENS=${{ secrets.SUMMARIZATION_MAX_SUMMARY_TOKENS }}

            # GitHub
            GITHUB_APP_ID=${{ secrets.GH_APP_ID }}
            GITHUB_ORG=${{ secrets.GITHUB_ORG }}

            # Telegram
            TELEGRAM_BOT_TOKEN=${{ secrets.TELEGRAM_BOT_TOKEN }}
            ADMIN_TELEGRAM_IDS=${{ secrets.ADMIN_TELEGRAM_IDS }}
            TELEGRAM_ID_ADMIN=${{ secrets.TELEGRAM_ID_ADMIN }}

            # Encryption
            SECRETS_ENCRYPTION_KEY=${{ secrets.SECRETS_ENCRYPTION_KEY }}

            # Infrastructure
            ORCHESTRATOR_HOSTNAME=${{ secrets.ORCHESTRATOR_HOSTNAME }}
            GHOST_SERVERS=${{ secrets.GHOST_SERVERS }}

            # Registry
            REGISTRY_USER=${{ secrets.REGISTRY_USER }}
            REGISTRY_PASSWORD=${{ secrets.REGISTRY_PASSWORD }}
            REGISTRY_PASSWORD_HASH=${{ secrets.REGISTRY_PASSWORD_HASH }}

            # Worker agents
            FACTORY_API_KEY=${{ secrets.FACTORY_API_KEY }}
            HOST_CLAUDE_DIR=${{ secrets.HOST_CLAUDE_DIR }}
            HOST_CODEX_HOME=${{ secrets.HOST_CODEX_HOME }}

            # Observability
            LANGCHAIN_API_KEY=${{ secrets.LANGCHAIN_API_KEY }}

            # Prod secret paths (used by docker-compose.prod.yml)
            GITHUB_APP_PEM_PATH=/opt/secrets/github_app.pem
            ENVEOF

      - name: Write secrets files to server
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            sudo mkdir -p /opt/secrets
            sudo chown deploy:deploy /opt/secrets

            echo '${{ secrets.GH_APP_PRIVATE_KEY }}' > /opt/secrets/github_app.pem
            chmod 600 /opt/secrets/github_app.pem

      - name: Pull latest code
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd ${{ env.DEPLOY_PATH }}
            git pull origin main

      - name: Build service images
        uses: appleboy/ssh-action@v1
        timeout-minutes: 15
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          command_timeout: 15m
          script: |
            cd ${{ env.DEPLOY_PATH }}
            docker compose -f docker-compose.yml -f docker-compose.prod.yml build

      - name: Pull worker base images from GHCR
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd ${{ env.DEPLOY_PATH }}
            GHCR_TOKEN='${{ secrets.GHCR_TOKEN }}' \
            GHCR_OWNER='${{ github.repository_owner }}' \
            bash infra/scripts/pull-worker-images.sh

      - name: Deploy
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd ${{ env.DEPLOY_PATH }}
            docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --remove-orphans

      - name: Run migrations
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd ${{ env.DEPLOY_PATH }}
            docker compose -f docker-compose.yml -f docker-compose.prod.yml exec -T api alembic upgrade head

      - name: Health check
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            echo "Waiting for API to be healthy..."
            timeout=60
            while ! curl -sf http://127.0.0.1:8000/health > /dev/null 2>&1; do
              if [ $timeout -le 0 ]; then
                echo "FATAL: API health check failed after 60s"
                cd ${{ env.DEPLOY_PATH }}
                docker compose -f docker-compose.yml -f docker-compose.prod.yml logs --tail=50 api
                exit 1
              fi
              sleep 2
              timeout=$((timeout - 2))
            done
            echo "API is healthy"

      - name: Cleanup
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.PROD_HOST }}
          username: deploy
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            docker image prune -f