deploy.yml

name: Deploy

on:
  workflow_run:
    workflows: ['CI']
    types: [completed]
    branches: ['main']
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: true

jobs:
  deploy:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (
        github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'main'
      )
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY: ghcr.io
    steps:
      - name: Checkout workflow run commit
        if: github.event_name == 'workflow_run'
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Checkout manual dispatch ref
        if: github.event_name == 'workflow_dispatch'
        uses: actions/checkout@v4

      - name: Set deployment metadata
        run: |
          if [ "${{ github.event_name }}" = "workflow_run" ]; then
            DEPLOY_SHA="${{ github.event.workflow_run.head_sha }}"
          else
            DEPLOY_SHA="${GITHUB_SHA}"
          fi
          IMAGE_NAME=$(echo "${REGISTRY}/${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')
          echo "DEPLOY_SHA=${DEPLOY_SHA}" >> $GITHUB_ENV
          echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push image
        run: |
          docker buildx build \
            --platform linux/amd64 \
            --tag ${IMAGE_NAME}:${DEPLOY_SHA} \
            --tag ${IMAGE_NAME}:latest \
            --push .
          echo "IMAGE_REF=${IMAGE_NAME}:${DEPLOY_SHA}" >> $GITHUB_ENV

      - name: Deploy on VPS
        uses: appleboy/ssh-action@v1.2.0
        env:
          DEPLOY_SHA: ${{ env.DEPLOY_SHA }}
          IMAGE_REF: ${{ env.IMAGE_REF }}
          GHCR_USER: ${{ github.actor }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Expected deployment config:
          # vars.VPS_HOST=43.163.91.9
          # vars.VPS_USER=deploy
          # vars.VPS_WORKDIR=/home/workspace/letletme_data
          # secrets.VPS_SSH_KEY=<private key for deploy>
          VPS_WORKDIR: ${{ vars.VPS_WORKDIR }}
        with:
          host: ${{ vars.VPS_HOST }}
          username: ${{ vars.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          script_stop: true
          envs: DEPLOY_SHA,IMAGE_REF,GHCR_USER,GHCR_TOKEN,VPS_WORKDIR
          script: |
            set -euo pipefail
            LOWER_USER=$(echo "$GHCR_USER" | tr '[:upper:]' '[:lower:]')
            docker login ghcr.io -u "$LOWER_USER" -p "$GHCR_TOKEN"
            cd "$VPS_WORKDIR"
            git fetch --all
            git checkout --force main
            git reset --hard "$DEPLOY_SHA"
            APP_IMAGE="$IMAGE_REF" docker compose pull api worker
            APP_IMAGE="$IMAGE_REF" docker compose run --rm -T api bun run db:migrate
            APP_IMAGE="$IMAGE_REF" docker compose up -d --remove-orphans --no-build
            for attempt in $(seq 1 30); do
              if curl --fail --silent http://127.0.0.1/health >/dev/null; then
                break
              fi
              if [ "$attempt" -eq 30 ]; then
                echo "Health check failed after waiting for startup"
                APP_IMAGE="$IMAGE_REF" docker compose ps
                docker logs --tail 100 letletme_data-api-1 || true
                exit 1
              fi
              sleep 2
            done
            APP_IMAGE="$IMAGE_REF" docker compose ps