deploy-server.yml

name: Deploy Server

on:
  workflow_run:
    workflows: ["Build Preview"]
    types:
      - completed
    branches:
      - master
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy'
        required: true
        type: choice
        options:
          - public-test
          # - production
      skip_graceful_shutdown:
        description: 'Skip graceful shutdown (emergency deploy)'
        required: false
        default: false
        type: boolean

concurrency:
  group: deploy-${{ github.event.inputs.environment || 'auto' }}
  cancel-in-progress: false

permissions: {}

jobs:
  prepare:
    name: Prepare deployment
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      has_targets: ${{ steps.set-matrix.outputs.has_targets }}
    steps:
      - name: Build deployment matrix
        id: set-matrix
        env:
          TRIGGER: ${{ github.event_name }}
          SELECTED: ${{ github.event.inputs.environment }}
          WORKFLOW_SUCCESS: ${{ github.event.workflow_run.conclusion }}
        run: |
          # Define deployment targets as JSON
          TARGETS='[
            {"environment": "public-test", "image_tag": "preview", "on_preview": true, "on_release": false}
          ]'
          # {"environment": "production", "image_tag": "latest", "on_preview": false, "on_release": true}

          MATRIX=$(echo "$TARGETS" | jq -c '[.[] | select(
            (env.TRIGGER == "workflow_dispatch" and env.SELECTED == .environment) or
            (env.TRIGGER == "workflow_run" and env.WORKFLOW_SUCCESS == "success" and .on_preview) or
            (env.TRIGGER == "release" and .on_release)
          ) | {environment, image_tag}]')

          echo "matrix={\"include\":$MATRIX}" >> $GITHUB_OUTPUT
          echo "has_targets=$([ "$MATRIX" != "[]" ] && echo true || echo false)" >> $GITHUB_OUTPUT

  deploy:
    name: Deploy ${{ matrix.environment }}
    needs: prepare
    if: needs.prepare.outputs.has_targets == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}

    environment: ${{ matrix.environment }}

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          sparse-checkout: |
            docker-compose.yml
          sparse-checkout-cone-mode: false

      - name: Graceful shutdown preparation
        if: github.event.inputs.skip_graceful_shutdown != 'true'
        run: |
          echo "::notice::Graceful shutdown hook placeholder for ${{ matrix.environment }}"

      - name: Create .env file
        env:
          DEPLOY_GAME_PORT: ${{ secrets.DEPLOY_GAME_PORT }}
          DEPLOY_VNC_PORT: ${{ secrets.DEPLOY_VNC_PORT }}
          DEPLOY_STEAM_AUTH_PORT: ${{ secrets.DEPLOY_STEAM_AUTH_PORT }}
        run: |
          echo "::group::Generate .env file for ${{ matrix.environment }}"

          # Validate required secrets
          missing=""
          [[ -z "$DEPLOY_GAME_PORT" ]] && missing="$missing DEPLOY_GAME_PORT"
          [[ -z "$DEPLOY_VNC_PORT" ]] && missing="$missing DEPLOY_VNC_PORT"
          [[ -z "$DEPLOY_STEAM_AUTH_PORT" ]] && missing="$missing DEPLOY_STEAM_AUTH_PORT"
          if [[ -n "$missing" ]]; then
            echo "::error::Missing secrets:$missing"
            echo "Configure these in Settings → Environments → ${{ matrix.environment }}"
            exit 1
          fi

          cat > .env << EOF
          # Auto-generated by GitHub Actions
          # Environment: ${{ matrix.environment }}
          IMAGE_VERSION=${{ matrix.image_tag }}
          STEAM_USERNAME=${{ secrets.DEPLOY_STEAM_USERNAME }}
          STEAM_PASSWORD=${{ secrets.DEPLOY_STEAM_PASSWORD }}
          STEAM_REFRESH_TOKEN=${{ secrets.DEPLOY_STEAM_REFRESH_TOKEN }}
          VNC_PASSWORD=${{ secrets.DEPLOY_VNC_PASSWORD }}
          GAME_PORT=$DEPLOY_GAME_PORT
          VNC_PORT=$DEPLOY_VNC_PORT
          STEAM_AUTH_PORT=$DEPLOY_STEAM_AUTH_PORT
          DISABLE_RENDERING=true
          # API authentication
          API_KEY=${{ secrets.DEPLOY_API_KEY }}
          # Discord bot (optional)
          DISCORD_BOT_TOKEN=${{ secrets.DEPLOY_DISCORD_BOT_TOKEN }}
          DISCORD_CHAT_CHANNEL_ID=${{ secrets.DEPLOY_DISCORD_CHAT_CHANNEL_ID }}
          EOF
          sed -i 's/^          //' .env
          echo "::endgroup::"

      - name: Create deploy directory
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.DEPLOY_SSH_HOST }}
          username: ${{ secrets.DEPLOY_SSH_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_SSH_PORT || 22 }}
          script: mkdir -p ~/srv/${{ matrix.environment }}

      - name: Copy files to server
        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
        with:
          host: ${{ secrets.DEPLOY_SSH_HOST }}
          username: ${{ secrets.DEPLOY_SSH_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_SSH_PORT || 22 }}
          source: "docker-compose.yml,.env"
          target: ~/srv/${{ matrix.environment }}

      - name: Pull and restart containers
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.DEPLOY_SSH_HOST }}
          username: ${{ secrets.DEPLOY_SSH_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_SSH_PORT || 22 }}
          script: |
            set -e
            cd ~/srv/${{ matrix.environment }}

            echo "::group::Pull images"
            docker compose pull
            echo "::endgroup::"

            echo "::group::Stop containers"
            docker compose down --timeout 30 || true
            echo "::endgroup::"

            echo "::group::Setup steam-auth and download game"
            docker compose run --rm steam-auth setup
            echo "::endgroup::"

            echo "::group::Start containers"
            docker compose up -d
            echo "::endgroup::"

            echo "::group::Cleanup"
            docker image prune -f
            echo "::endgroup::"

      - name: Verify deployment
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.DEPLOY_SSH_HOST }}
          username: ${{ secrets.DEPLOY_SSH_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_SSH_PORT || 22 }}
          script: |
            set -e
            cd ~/srv/${{ matrix.environment }}

            echo "::group::Wait for startup"
            sleep 30
            echo "::endgroup::"

            echo "::group::Health check"
            if docker compose ps | grep -qE "unhealthy|Exit"; then
              echo "::error::Container health check failed"
              docker compose logs --tail=50
              exit 1
            fi
            docker compose ps
            echo "::endgroup::"

      - name: Build summary
        run: |
          echo "### Deployed: ${{ matrix.environment }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Setting | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|---------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Environment | \`${{ matrix.environment }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Image | \`${{ matrix.image_tag }}\` |" >> $GITHUB_STEP_SUMMARY

      - name: Discord notification
        if: success()
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
        run: |
          if [ -n "$DISCORD_WEBHOOK" ]; then
            jq -n \
              --arg env "${{ matrix.environment }}" \
              --arg tag "${{ matrix.image_tag }}" \
              --arg commit "${GITHUB_SHA:0:7}" \
              '{
                embeds: [{
                  title: "Server Deployed",
                  color: 3066993,
                  fields: [
                    {name: "Environment", value: $env, inline: true},
                    {name: "Image", value: ("`" + $tag + "`"), inline: true},
                    {name: "Commit", value: ("`" + $commit + "`"), inline: true}
                  ]
                }]
              }' | curl -H "Content-Type: application/json" -d @- "$DISCORD_WEBHOOK"
          fi

      - name: Discord notification (failure)
        if: failure()
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
        run: |
          if [ -n "$DISCORD_WEBHOOK" ]; then
            jq -n \
              --arg env "${{ matrix.environment }}" \
              --arg commit "${GITHUB_SHA:0:7}" \
              '{
                embeds: [{
                  title: "Deployment Failed",
                  color: 15158332,
                  fields: [
                    {name: "Environment", value: $env, inline: true},
                    {name: "Commit", value: ("`" + $commit + "`"), inline: true}
                  ]
                }]
              }' | curl -H "Content-Type: application/json" -d @- "$DISCORD_WEBHOOK"
          fi