gendesign/.forgejo/workflows/deploy-tradein.yml

name: Deploy Trade-In

# Forgejo Actions — отдельный pipeline для подпроекта tradein-mvp/.
# Триггерится только на изменения внутри tradein-mvp/ (или этого workflow),
# не пересекается с основным deploy.yml.
on:
  push:
    branches: [main]
    paths:
      - "tradein-mvp/**"
      - ".forgejo/workflows/deploy-tradein.yml"
  workflow_dispatch:

concurrency:
  group: deploy-tradein-prod
  cancel-in-progress: false

env:
  IMAGE_BACKEND: ghcr.io/lekss361/gendesign-tradein-backend
  IMAGE_FRONTEND: ghcr.io/lekss361/gendesign-tradein-frontend

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      infra: ${{ steps.filter.outputs.infra }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            backend:
              - 'tradein-mvp/backend/**'
            frontend:
              - 'tradein-mvp/frontend/**'
            infra:
              - 'tradein-mvp/docker-compose.prod.yml'
              - 'tradein-mvp/deploy/**'
              - '.forgejo/workflows/deploy-tradein.yml'

  build-backend:
    runs-on: ubuntu-latest
    needs: changes
    if: |
      needs.changes.outputs.backend == 'true' ||
      needs.changes.outputs.infra == 'true' ||
      github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v4

      - name: Login to GHCR (shell-based — docker/login-action@v3 unreliable под Forgejo Actions)
        env:
          GHCR_PAT: ${{ secrets.GHCR_PAT }}
        run: |
          echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build & push tradein-backend
        uses: docker/build-push-action@v6
        with:
          context: ./tradein-mvp/backend
          push: true
          cache-from: type=registry,ref=${{ env.IMAGE_BACKEND }}:buildcache
          cache-to: type=registry,ref=${{ env.IMAGE_BACKEND }}:buildcache,mode=max
          tags: |
            ${{ env.IMAGE_BACKEND }}:latest
            ${{ env.IMAGE_BACKEND }}:${{ github.sha }}

  build-frontend:
    runs-on: ubuntu-latest
    needs: changes
    if: |
      needs.changes.outputs.frontend == 'true' ||
      needs.changes.outputs.infra == 'true' ||
      github.event_name == 'workflow_dispatch'
    steps:
      - uses: actions/checkout@v4

      - name: Login to GHCR (shell-based — docker/login-action@v3 unreliable под Forgejo Actions)
        env:
          GHCR_PAT: ${{ secrets.GHCR_PAT }}
        run: |
          echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build & push tradein-frontend
        uses: docker/build-push-action@v6
        with:
          context: ./tradein-mvp/frontend
          push: true
          # basePath=/trade-in baked-in во время build (Next.js)
          build-args: |
            NEXT_PUBLIC_BASE_PATH=/trade-in
            NEXT_PUBLIC_API_BASE_URL=/trade-in
          cache-from: type=registry,ref=${{ env.IMAGE_FRONTEND }}:buildcache
          cache-to: type=registry,ref=${{ env.IMAGE_FRONTEND }}:buildcache,mode=max
          tags: |
            ${{ env.IMAGE_FRONTEND }}:latest
            ${{ env.IMAGE_FRONTEND }}:${{ github.sha }}

  deploy:
    runs-on: ubuntu-latest
    needs: [changes, build-backend, build-frontend]
    if: |
      always() &&
      !cancelled() &&
      needs.build-backend.result != 'failure' &&
      needs.build-frontend.result != 'failure'
    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.0.3
        env:
          IMAGE_TAG: latest
          GHCR_PAT: ${{ secrets.GHCR_PAT }}
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          port: ${{ secrets.DEPLOY_PORT }}
          envs: IMAGE_TAG,GHCR_PAT
          script: |
            set -euo pipefail
            cd /opt/gendesign

            # repo уже clone'ен — origin = Forgejo. Подтягиваем последний main.
            git fetch origin main
            git reset --hard origin/main

            cd tradein-mvp

            # .env.runtime создаётся вручную при первом запуске (см. README-АДМИНУ.md).
            # Здесь только подгружаем переменные для docker compose (POSTGRES_PASSWORD).
            if [ ! -f .env.runtime ]; then
              echo "ERROR: /opt/gendesign/tradein-mvp/.env.runtime отсутствует."
              echo "Создай его вручную (см. tradein-mvp/README.md или DEPLOY.md)."
              exit 1
            fi
            chmod 600 .env.runtime
            set -a; source .env.runtime; set +a

            # External network для Caddy (он в основном gendesign-стеке)
            docker network inspect gendesign_shared >/dev/null 2>&1 \
                || docker network create gendesign_shared

            # Re-login to GHCR (PAT может быть rotated)
            echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin

            export IMAGE_TAG="$IMAGE_TAG"
            docker compose -p gendesign-tradein -f docker-compose.prod.yml pull
            docker compose -p gendesign-tradein -f docker-compose.prod.yml up -d

            # Применяем SQL миграции (если есть data/sql/*.sql)
            # Postgres init load *.sql из /docker-entrypoint-initdb.d ТОЛЬКО при первом
            # старте volume. Здесь — для повторных миграций после первого запуска.
            sleep 5
            for sql_file in $(ls -1 backend/data/sql/*.sql 2>/dev/null | sort); do
              fname=$(basename "$sql_file")
              echo "→ Migration: $fname"
              docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
                psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein \
                -v ON_ERROR_STOP=on < "$sql_file" \
                || echo "  (skipped — already applied or error: $fname)"
            done

            # Retry backend lifespan hook AFTER migrations applied.
            # tradein-backend startup runs ensure_fdw_user_mapping which needs
            # FOREIGN SERVER gendesign_remote (created by 060_postgres_fdw_extension.sql).
            # Without restart, the first compose-up's startup hook failed with
            # "server gendesign_remote does not exist" because migrations hadn't run yet.
            # See PR #493 deploy/1156 for the incident details.
            echo "→ Restarting tradein-backend so lifespan hook retries USER MAPPING setup"
            docker restart tradein-backend
            # Give backend time to come up before Caddy reload + health check below
            sleep 5

            # Caddy reload — основной Caddyfile содержит inline tradein routes
            # (см. Caddyfile в корне репы). Reload, чтобы Caddy перечитал DNS
            # tradein-backend / tradein-frontend (они в gendesign_shared network).
            cd /opt/gendesign
            docker compose -p gendesign -f docker-compose.prod.yml exec -T caddy \
              caddy reload --config /etc/caddy/Caddyfile || true

            # Health check
            for i in $(seq 1 30); do
              docker compose -p gendesign-tradein -f /opt/gendesign/tradein-mvp/docker-compose.prod.yml \
                exec -T backend curl -fsS http://localhost:8000/health && break
              sleep 1
            done

            # Cleanup старых образов
            for repo in ghcr.io/lekss361/gendesign-tradein-backend \
                        ghcr.io/lekss361/gendesign-tradein-frontend; do
              docker images "$repo" --format '{{.Repository}}:{{.Tag}}' \
                | grep -v ':latest$' | tail -n +3 \
                | xargs -r docker rmi 2>/dev/null || true
            done
            docker image prune -af || true