deploy-prod.yml

name: Deploy to Production

on:
  push:
    branches:
      - "release/**"
  workflow_dispatch:
    inputs:
      sha:
        description: Commit SHA to deploy (defaults to HEAD of current branch)
        required: false
        type: string

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  # ── Detect what changed ───────────────────────────────────────────────────────
  filter:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      api: ${{ steps.changes.outputs.api }}
      dashboard: ${{ steps.changes.outputs.dashboard }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.sha || github.sha }}
      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            api:
              - 'platform/apps/api/**'
              - 'platform/packages/db/**'
              - 'platform/packages/shared/**'
              - 'platform/packages/azure/**'
              - 'platform/packages/config/**'
            dashboard:
              - 'platform/apps/dashboard/**'
              - 'platform/packages/shared/**'
              - 'platform/packages/config/**'

  # ── Build & push platform API ─────────────────────────────────────────────────
  # Images are built BEFORE the manual approval gate so reviewers see what they approve.
  build-api:
    name: Build API image
    needs: filter
    if: needs.filter.outputs.api == 'true'
    uses: ./.github/workflows/_docker-build-push.yml
    with:
      image-name: platform-api
      dockerfile: apps/api/Dockerfile
      context: platform
      acr-login-server: deploycloudproductionacr.azurecr.io
      extra-tags: stable
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

  # ── Build & push platform Dashboard ──────────────────────────────────────────
  build-dashboard:
    name: Build Dashboard image
    needs: filter
    if: needs.filter.outputs.dashboard == 'true'
    uses: ./.github/workflows/_docker-build-push.yml
    with:
      image-name: platform-dashboard
      dockerfile: apps/dashboard/Dockerfile
      context: platform
      acr-login-server: deploycloudproductionacr.azurecr.io
      extra-tags: stable
      build-args: |
        NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL }}
        NEXT_PUBLIC_APP_NAME=${{ secrets.NEXT_PUBLIC_APP_NAME }}
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

  # ── Update Container Apps — manual approval gate enforced by GitHub Environment ─
  deploy-platform:
    name: Deploy to Container Apps (production)
    needs: [build-api, build-dashboard]
    if: always() && !failure() && !cancelled()
    runs-on: ubuntu-latest
    environment: production        # ← reviewer must approve before this job runs
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          use-oidc: true

      - name: Update API Container App
        if: needs.build-api.result == 'success'
        run: |
          SHA_SHORT="${GITHUB_SHA::8}"
          az containerapp update \
            --name deploycloud-production-api \
            --resource-group deploycloud-production-rg \
            --image deploycloudproductionacr.azurecr.io/platform-api:sha-${SHA_SHORT}

      - name: Update Dashboard Container App
        if: needs.build-dashboard.result == 'success'
        run: |
          SHA_SHORT="${GITHUB_SHA::8}"
          az containerapp update \
            --name deploycloud-production-dashboard \
            --resource-group deploycloud-production-rg \
            --image deploycloudproductionacr.azurecr.io/platform-dashboard:sha-${SHA_SHORT}

      - name: Deployment summary
        run: |
          SHA_SHORT="${GITHUB_SHA::8}"
          {
            echo "### Production Deployment — \`sha-${SHA_SHORT}\`"
            echo "| Service | Result |"
            echo "|---------|--------|"
            echo "| API | ${{ needs.build-api.result }} |"
            echo "| Dashboard | ${{ needs.build-dashboard.result }} |"
          } >> "$GITHUB_STEP_SUMMARY"

  # ── Run DB migrations ─────────────────────────────────────────────────────────
  migrate:
    name: Run DB Migrations
    needs: [build-api, deploy-platform]
    if: needs.build-api.result == 'success'
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          use-oidc: true

      - name: Create ephemeral migration job
        run: |
          SHA_SHORT="${GITHUB_SHA::8}"
          JOB_NAME="deploycloud-production-migrate-${SHA_SHORT}"
          echo "JOB_NAME=${JOB_NAME}" >> "$GITHUB_ENV"

          IDENTITY_ID=$(az identity show \
            --name deploycloud-production-platform-id \
            --resource-group deploycloud-production-rg \
            --query id -o tsv)

          az containerapp job create \
            --name "${JOB_NAME}" \
            --resource-group deploycloud-production-rg \
            --environment deploycloud-production-cae \
            --trigger-type Manual \
            --replica-timeout 600 \
            --replica-retry-limit 1 \
            --replica-completion-count 1 \
            --parallelism 1 \
            --image "deploycloudproductionacr.azurecr.io/platform-api:sha-${SHA_SHORT}" \
            --registry-server deploycloudproductionacr.azurecr.io \
            --registry-identity "${IDENTITY_ID}" \
            --env-vars "NODE_ENV=production" \
            --command "node" \
            --args "apps/api/dist/migrate.js"

      - name: Start migration job
        run: |
          EXECUTION_NAME=$(az containerapp job start \
            --name "${JOB_NAME}" \
            --resource-group deploycloud-production-rg \
            --query name -o tsv)
          echo "EXECUTION_NAME=${EXECUTION_NAME}" >> "$GITHUB_ENV"
          echo "Migration execution started: ${EXECUTION_NAME}"

      - name: Wait for migration to complete
        timeout-minutes: 15
        run: |
          for i in $(seq 1 30); do
            STATUS=$(az containerapp job execution show \
              --name "${JOB_NAME}" \
              --resource-group deploycloud-production-rg \
              --job-execution-name "${EXECUTION_NAME}" \
              --query "properties.status" -o tsv)
            echo "Status: ${STATUS} (attempt ${i}/30)"
            if [ "${STATUS}" = "Succeeded" ]; then
              echo "Migration completed successfully"
              exit 0
            elif [ "${STATUS}" = "Failed" ]; then
              echo "Migration job failed"
              exit 1
            fi
            sleep 20
          done
          echo "Migration timed out"
          exit 1

      - name: Cleanup migration job
        if: always()
        run: |
          az containerapp job delete \
            --name "${JOB_NAME}" \
            --resource-group deploycloud-production-rg \
            --yes 2>/dev/null || true

  # ── Smoke test ────────────────────────────────────────────────────────────────
  smoke-test:
    name: Smoke Test (production)
    needs: [deploy-platform, migrate]
    if: always() && needs.deploy-platform.result == 'success'
    runs-on: ubuntu-latest

    steps:
      - name: Wait for Container Apps to settle
        run: sleep 30

      - name: Health check — API
        run: |
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
            --retry 5 --retry-delay 15 --retry-connrefused \
            "${{ vars.PROD_API_URL }}/health")
          if [ "$STATUS" != "200" ]; then
            echo "Health check returned HTTP ${STATUS}"
            exit 1
          fi
          echo "Production API is healthy (HTTP ${STATUS})"