# .github/workflows/deploy.yml
# Builds, pushes images, and deploys to production server on push to main branch.
# FriendlyRussian666

name: Build and Deploy to Production

on:
    push:
        branches:
            - main

jobs:
    build-push-deploy:
        name: Build, Push Docker Images and Deploy
        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write # Needed to push to GHCR

        steps:
            - name: Checkout code
              uses: actions/checkout@v4

            # --- Docker Setup ---
            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Log in to Github Container Registry
              uses: docker/login-action@v3
              with:
                registry: ghcr.io
                username: ${{ github.actor }}
                password: ${{ secrets.GITHUB_TOKEN }}

            # --- Metadata for Image Tagging ---
            - name: Extract metadata (tags, labels) for Docker
              id: meta # Single metadata step for all images
              uses: docker/metadata-action@v5
              with:
                images: | # List all images to be built
                    ghcr.io/${{ github.repository }}/backend
                    ghcr.io/${{ github.repository }}/frontend
                    ghcr.io/${{ github.repository }}/nginx
                tags: | # Define tags for the images
                    type=sha
                    type=raw,value=latest

            # --- Build and Push Each Image ---
            - name: Build and push Backend image
              uses: docker/build-push-action@v5
              with:
                context: ./backend
                file: ./backend/Dockerfile
                push: true
                tags: ${{ steps.meta.outputs.tags }}
                labels: ${{ steps.meta.outputs.labels }}
                image-name: ghcr.io/${{ github.repository }}/backend
                cache-from: type=gha
                cache-to: type=gha,mode=max

            - name: Build and push Frontend image
              uses: docker/build-push-action@v5
              with:
                context: ./frontend
                file: ./frontend/Dockerfile
                push: true
                tags: ${{ steps.meta.outputs.tags }}
                labels: ${{ steps.meta.outputs.labels }}
                image-name: ghcr.io/${{ github.repository }}/frontend
                cache-from: type=gha
                cache-to: type=gha,mode=max

            - name: Build and push Nginx image
              uses: docker/build-push-action@v5
              with:
                context: ./nginx
                file: ./nginx/Dockerfile
                push: true
                tags: ${{ steps.meta.outputs.tags }}
                labels: ${{ steps.meta.outputs.labels }}
                image-name: ghcr.io/${{ github.repository }}/nginx
                cache-from: type=gha
                cache-to: type=gha,mode=max

            # --- Deploy to server ---
            - name: Configure SSH
              uses: webfactory/[email protected]
              with:
                ssh-private-key: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}

            - name: Add Production Server to Known Hosts
              run: |
                mkdir -p ~/.ssh
                ssh-keyscan -H ${{ secrets.PRODUCTION_SSH_HOST }} >> ~/.ssh/known_hosts
                chmod 600 ~/.ssh/known_hosts ~/.ssh/config || true # Handle config file potentially not existing

            - name: Deploy Application via SSH
              env:
                # Pass production secrets/env vars needed on the server
                PRODUCTION_ENV_FILE_CONTENT: ${{ secrets.PRODUCTION_ENV_FILE }} # Full .env content
                # Use the commit SHA for image tags during deployment
                # This ensures we deploy the exact image we just built
                IMAGE_TAG: ${{ github.sha }}
                GHCR_USER: ${{ github.actor }}
                GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
              run: |
                # Use ssh -T to prevent pseudo-terminal allocation issues
                # Use single quotes around EOF to prevent local shell expansion
                ssh -T ${{ secrets.PRODUCTION_SSH_USER }}@${{ secrets.PRODUCTION_SSH_HOST }} << 'EOF'
                # Navigate to app directory on the server
                # IMPORTANT: Set this path correctly! Verify it on your server.
                export DEPLOY_DIR=/dev/project/yourprojectname # <------------------------ !!!
                echo "Deploying to: $DEPLOY_DIR"
                cd $DEPLOY_DIR || exit 1 # Exit if directory doesn't exist

                # Stop execution if any command fails
                set -e

                # Create the .env file from the secret
                echo "Creating .env file..."
                # printf for safer handling of special characters in the secret
                printf "%s\n" "$PRODUCTION_ENV_FILE_CONTENT" > .env
                echo "Deployed SHA: $IMAGE_TAG at $(date)" >> .env

                # Set image tags for docker-compose using environment variables
                # Ensure docker-compose.yml uses these like image: ghcr.io/...:${IMAGE_TAG:-latest}
                # These vars are exported for the subsequent docker compose commands
                export IMAGE_TAG=$IMAGE_TAG # Use the commit SHA tag

                # Login to GHCR on the server
                echo "Logging into GHCR..."
                echo $GHCR_TOKEN | docker login ghcr.io -u $GHCR_USER --password-stdin

                # Pull the specific images tagged with the commit SHA
                # Use the production docker-compose file (docker-compose.yml, I also have docker-compose.dev.yml, so this is important)
                echo "Pulling images with tag: $IMAGE_TAG"
                # Make sure your docker-compose.yml references the images like:
                # image: ghcr.io/your_user/your_repo/backend:${IMAGE_TAG:-latest}
                docker compose -f docker-compose.yml pull

                # Stop/remove old containers, start new ones based on pulled images
                echo "Starting application containers..."
                docker compose -f docker-compose.yml up -d --remove-orphans

                # Run Django migrations
                echo "Running Database Migrations..."
                # Use -T to disable pseudo-tty allocation for exec
                docker compose -f docker-compose.yml exec -T backend python manage.py migrate --noinput

                # If you want: Prune old Docker images/containers to save space
                echo "Pruning Docker resources..."
                docker image prune -af || true # Allow prune to fail harmlessly if nothing to prune
                docker container prune -f || true
                # Be cautious with volume prune in production - only if you are SURE you don't need old unnamed volumes
                # docker volume prune -f || true

                echo "Production Deployment Complete!"
                EOF