deploy.yml

name: CD - Production Deployment

on:
  # push:
  #   branches: [main]
  workflow_dispatch:  # Manual trigger only (configure secrets before enabling auto-deploy)

jobs:
  deploy:
    name: Deploy to Production
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20.x'
          cache: 'pnpm'

      - name: Install Node.js dependencies
        run: pnpm install --frozen-lockfile --prod

      - name: Install Doppler CLI
        run: |
          # Follow environment-setup-analyzer: Use package manager first
          curl -sLf --retry 3 --tlsv1.2 --proto "=https" 'https://packages.doppler.com/public/cli/gpg.DE2A7741.key' | sudo apt-key add -
          echo "deb https://packages.doppler.com/public/cli/deb/debian any-version main" | sudo tee /etc/apt/sources.list.d/doppler-cli.list
          sudo apt-get update && sudo apt-get install doppler

      - name: Install PM2 globally
        run: pnpm add -g pm2

      - name: Validate deployment files
        run: |
          echo "Validating deployment artifacts..."

          # Check critical files exist
          test -f api/server.ts || test -f api/server.js || (echo "❌ API server not found" && exit 1)

          # Check package.json has dashboard script
          grep -q '"dashboard"' package.json || (echo "❌ Dashboard script not found" && exit 1)

          echo "✅ All deployment files validated"

      - name: Configure Doppler
        run: |
          echo "${{ secrets.DOPPLER_TOKEN }}" | doppler configure set token --scope / --silent
        env:
          DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}

      - name: Deploy with rsync
        uses: burnett01/rsync-deployments@6.0.0
        with:
          switches: -avzr --delete --exclude='.git*' --exclude='node_modules' --exclude='tests'
          path: ./
          remote_path: ${{ secrets.DEPLOY_PATH }}
          remote_host: ${{ secrets.DEPLOY_HOST }}
          remote_user: ${{ secrets.DEPLOY_USER }}
          remote_key: ${{ secrets.DEPLOY_SSH_KEY }}

      - name: Install dependencies on server
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            cd ${{ secrets.DEPLOY_PATH }}

            # Ensure logs directory exists for PM2
            mkdir -p logs

            # Install pnpm first if not available
            command -v pnpm || npm install -g pnpm

            # Install Node.js dependencies with Doppler
            doppler run -c prd -- pnpm install --frozen-lockfile --prod

            # Install ast-grep (required for duplicate detection pipeline)
            npm install -g @ast-grep/cli

      - name: Restart services with PM2
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            cd ${{ secrets.DEPLOY_PATH }}

            # Check if services are already running
            if pm2 list | grep -q "aleph-dashboard\|aleph-worker"; then
              echo "Services found, restarting with config/ecosystem.config.cjs..."
              doppler run -c prd -- pm2 restart config/ecosystem.config.cjs
            else
              echo "Services not found, starting with config/ecosystem.config.cjs..."
              doppler run -c prd -- pm2 start config/ecosystem.config.cjs
            fi

            # Save PM2 configuration
            pm2 save

            # Show status
            pm2 status

      - name: Health check
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            echo "Waiting for services to start..."
            sleep 10

            # Check Redis connectivity (used for scan caching)
            if redis-cli ping | grep -q "PONG"; then
              echo "✅ Redis is healthy"
            else
              echo "⚠️ Redis not available (caching disabled)"
            fi

            # Check dashboard health
            RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/health)
            if [ "$RESPONSE" -eq 200 ]; then
              echo "✅ Dashboard is healthy"
            else
              echo "❌ Dashboard health check failed (HTTP $RESPONSE)"
              exit 1
            fi

            # Check Doppler health monitor (Bugfix E4 verification)
            RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/api/health/doppler)
            if [ "$RESPONSE" -eq 200 ]; then
              echo "✅ Doppler health monitor is active"
            else
              echo "❌ Doppler health monitor check failed (HTTP $RESPONSE)"
              exit 1
            fi

            # Verify bugfix E1: Dashboard returns all pipelines
            PIPELINE_COUNT=$(curl -s http://localhost:8080/api/status | jq '.pipelines | length')
            if [ "$PIPELINE_COUNT" -ge 7 ]; then
              echo "✅ Dashboard returns $PIPELINE_COUNT pipelines (E1 verified)"
            else
              echo "❌ Dashboard only returns $PIPELINE_COUNT pipelines, expected >= 7"
              exit 1
            fi

            # Verify bugfix E2: Pagination returns accurate totals
            # Note: Skip if no repomix jobs exist yet
            REPOMIX_RESPONSE=$(curl -s 'http://localhost:8080/api/sidequest/pipeline-runners/repomix/jobs?limit=10')
            REPOMIX_STATUS=$(echo $REPOMIX_RESPONSE | jq -r '.total // "skip"')
            if [ "$REPOMIX_STATUS" != "skip" ] && [ "$REPOMIX_STATUS" != "null" ]; then
              echo "✅ Pagination endpoint working (E2 verified)"
            else
              echo "⚠️ Pagination endpoint returned no data (may be normal for new deployment)"
            fi

      - name: Notify deployment success
        if: success()
        run: |
          echo "🚀 Deployment successful!"
          echo "📊 Dashboard: http://${{ secrets.DEPLOY_HOST }}:8080/"
          echo "❤️  Health: http://${{ secrets.DEPLOY_HOST }}:8080/health"

      - name: Rollback on failure
        if: failure()
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script: |
            cd ${{ secrets.DEPLOY_PATH }}

            echo "⚠️ Deployment failed, attempting rollback..."

            # Restore previous PM2 configuration
            pm2 resurrect

            echo "Rollback complete. Please check logs with: pm2 logs"