cd-dev.yml

name: CI/CD using github actions & docker

on:
  workflow_dispatch:
    inputs:
      counter_phase:
        description: Audit or apply the durable counter snapshot and hourly Neon checkpoint
        type: choice
        options: ['', audit, apply, checkpoint]
        default: ''
      rehome_phase:
        description: Stage, activate, or verify the reviewed Neon project migration
        type: choice
        options: ['', prepare, apply, verify]
        default: ''
      audit_only:
        description: Inspect backend versions and worker settings without deploying
        type: boolean
        default: false
      rollout_idle:
        description: Deploy the immutable wake-on-work image to dev, latest and stable (requires stage_only)
        type: boolean
        default: false
      image_revision:
        description: Reuse an already built immutable revision for rollout_idle
        type: string
        default: ''
      publish_idle_revision:
        description: Publish aliases for an immutable revision already verified on all three backends
        type: string
        default: ''
      stage_only:
        description: Build an immutable image without deploying
        type: boolean
        default: false
  push:
    branches:
      - develop

permissions:
  contents: read

jobs:
  push_to_registry:
    if: ${{ !inputs.audit_only && !inputs.publish_idle_revision && !inputs.image_revision && !inputs.rehome_phase && !inputs.counter_phase }}
    name: Push to aws container registry
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'corretto'

      - name: make application-prod.yml
        if: inputs.stage_only || contains(github.ref, 'develop') || contains(github.ref, 'main')
        run: |
          cd ./src/main/resources
          touch ./application-prod.yml
          echo "${{ secrets.YML_PROD }}" > ./application-prod.yml
        shell: bash

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Build with Gradle
        env:
          SPRING_PROFILES_ACTIVE: prod
        run: ./gradlew clean build --stacktrace
        shell: bash

      - name: Build immutable cutover image
        if: inputs.stage_only
        env:
          REGISTRY_USER: ${{ secrets.DOCKER_USER }}
          REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: |
          printf '%s' "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USER" --password-stdin
          docker build -t "$REGISTRY_USER/kodaero-app:neon-$GITHUB_SHA" -f ./Dockerfile .
          docker push "$REGISTRY_USER/kodaero-app:neon-$GITHUB_SHA"

      - name: Docker build & push to prod
        if: ${{ !inputs.stage_only && (contains(github.ref, 'develop') || contains(github.ref, 'main')) }}
        run: |
          docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }}
          docker build -t kodaero-dev -f ./Dockerfile .
          docker tag kodaero-dev:latest ${{ secrets.DOCKER_USER }}/kodaero-dev:latest
          docker push ${{ secrets.DOCKER_USER }}/kodaero-dev:latest
          
          
  pull_from_registry:
    if: ${{ !inputs.stage_only && !inputs.audit_only && !inputs.publish_idle_revision && !inputs.rehome_phase && !inputs.counter_phase }}
    name: Connect server ssh and pull from container registry
    needs: push_to_registry
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to prod
        if: contains(github.ref, 'develop') || contains(github.ref, 'main')
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.HOST_NAME }}
          username: ${{ secrets.USER_NAME }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.PORT }}
          script: |
            docker pull ${{ secrets.DOCKER_USER }}/kodaero-dev:latest
            cd infra
            chmod +x ./deploy-dev.sh
            sudo ./deploy-dev.sh
            docker image prune -f

  audit_backends:
    if: ${{ inputs.audit_only }}
    runs-on: ubuntu-latest
    steps:
      - name: Inspect deployed backends without printing credentials
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.HOST_NAME }}
          username: ${{ secrets.USER_NAME }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.PORT }}
          script: |
            set -eu
            docker ps --format '{{.Names}} {{.Image}} {{.Status}}'
            docker inspect app-dev app-latest app-stable | python3 -c '
            import json,sys
            allowed={"PUSH_STORAGE","PUSH_AUDIENCE","PUSH_WORKER_ENABLED","PUSH_RECEIPT_WORKER_ENABLED","PUSH_SURVEY_WORKER_ENABLED","PUSH_OUTBOX_ENABLED","PUSH_WORKER_FIXED_DELAY_MS","PUSH_RECEIPT_WORKER_FIXED_DELAY_MS","PUSH_SURVEY_POLL_INTERVAL_MS","PUSH_IDLE_NAMESPACE","PUSH_IDLE_RECONCILE_CRON","SERVER_PORT","SPRING_PROFILES_ACTIVE"}
            for c in json.load(sys.stdin):
                print(c["Name"], c["Config"]["Image"], c["Image"], c["State"]["Status"])
                print("ports", c["NetworkSettings"]["Ports"])
                print("network", c["HostConfig"]["NetworkMode"], "port arguments", [v for v in c["Config"].get("Cmd",[]) or [] if v.startswith("--server.port=")])
                print("compose files", c["Config"].get("Labels",{}).get("com.docker.compose.project.config_files"))
                print("worker settings", dict(v.split("=",1) for v in c["Config"]["Env"] if v.split("=",1)[0] in allowed))
                print("configuration mounts", [(m["Source"],m["Destination"]) for m in c.get("Mounts",[]) if "yml" in m["Destination"] or "yaml" in m["Destination"]])
            '
            counter_script=$(mktemp)
            trap 'rm -f "$counter_script"' EXIT
            curl --fail --silent --show-error 'https://raw.githubusercontent.com/DevKor-github/team-c-back/${{ github.sha }}/scripts/verify-push-idle.py' -o "$counter_script"
            sudo -n python3 "$counter_script"

  rehome_neon:
    if: ${{ inputs.rehome_phase }}
    runs-on: ubuntu-latest
    steps:
      - name: Switch only the reviewed Neon connection on the existing immutable backend
        uses: appleboy/ssh-action@master
        env:
          NEON_REHOME_PAYLOAD: ${{ secrets.NEON_REHOME_PAYLOAD }}
          REHOME_PHASE: ${{ inputs.rehome_phase }}
        with:
          host: ${{ secrets.HOST_NAME }}
          username: ${{ secrets.USER_NAME }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.PORT }}
          command_timeout: 15m
          envs: NEON_REHOME_PAYLOAD,REHOME_PHASE
          script: |
            set -eu
            rehome_script=$(mktemp)
            trap 'rm -f "$rehome_script"' EXIT
            curl --fail --silent --show-error 'https://raw.githubusercontent.com/DevKor-github/team-c-back/${{ github.sha }}/scripts/rehome-push-neon.py' -o "$rehome_script"
            sudo -n --preserve-env=NEON_REHOME_PAYLOAD python3 "$rehome_script" "$REHOME_PHASE"

  reduce_counter_compute:
    if: ${{ inputs.counter_phase }}
    runs-on: ubuntu-latest
    steps:
      - name: Preserve counter ledger and configure idle Neon checkpointing
        uses: appleboy/ssh-action@master
        env:
          COUNTER_COMPUTE_PAYLOAD: ${{ secrets.COUNTER_COMPUTE_PAYLOAD }}
          COUNTER_PHASE: ${{ inputs.counter_phase }}
        with:
          host: ${{ secrets.HOST_NAME }}
          username: ${{ secrets.USER_NAME }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.PORT }}
          command_timeout: 5m
          envs: COUNTER_COMPUTE_PAYLOAD,COUNTER_PHASE
          script: |
            set -eu
            counter_script=$(mktemp)
            trap 'rm -f "$counter_script"' EXIT
            curl --fail --silent --show-error 'https://raw.githubusercontent.com/DevKor-github/team-c-back/${{ github.sha }}/scripts/reduce-counter-compute.py' -o "$counter_script"
            sudo -n --preserve-env=COUNTER_COMPUTE_PAYLOAD python3 "$counter_script" "$COUNTER_PHASE"

  rollout_idle_workers:
    if: ${{ always() && !cancelled() && inputs.rollout_idle && inputs.stage_only && !inputs.audit_only && (needs.push_to_registry.result == 'success' || (needs.push_to_registry.result == 'skipped' && inputs.image_revision)) }}
    needs: push_to_registry
    runs-on: ubuntu-latest
    steps:
      - name: Roll out one verified image to every push worker
        uses: appleboy/ssh-action@master
        env:
          IMAGE_REVISION: ${{ inputs.image_revision || github.sha }}
        with:
          host: ${{ secrets.HOST_NAME }}
          username: ${{ secrets.USER_NAME }}
          key: ${{ secrets.SSH_KEY }}
          port: ${{ secrets.PORT }}
          command_timeout: 15m
          envs: IMAGE_REVISION
          script: |
            set -eu
            rollout_script=$(mktemp)
            trap 'rm -f "$rollout_script"' EXIT
            curl --fail --silent --show-error 'https://raw.githubusercontent.com/DevKor-github/team-c-back/${{ github.sha }}/scripts/deploy-push-idle.py' -o "$rollout_script"
            python3 "$rollout_script" "${{ secrets.DOCKER_USER }}/kodaero-app:neon-$IMAGE_REVISION" "$IMAGE_REVISION"

  publish_verified_idle_aliases:
    if: ${{ inputs.publish_idle_revision }}
    runs-on: ubuntu-latest
    steps:
      - name: Publish the verified immutable image for subsequent standard deployments
        env:
          REGISTRY_USER: ${{ secrets.DOCKER_USER }}
          REGISTRY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
          REVISION: ${{ inputs.publish_idle_revision }}
        run: |
          set -eu
          [[ "$REVISION" =~ ^[0-9a-f]{40}$ ]]
          printf '%s' "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USER" --password-stdin
          image="$REGISTRY_USER/kodaero-app:neon-$REVISION"
          docker pull "$image"
          test "$(docker inspect --format '{{ index .Config.Labels "com.kodaero.push-idle" }}' "$image")" = wake-v1
          for alias in "$REGISTRY_USER/kodaero-app:latest" "$REGISTRY_USER/kodaero-app:stable" "$REGISTRY_USER/kodaero-dev:latest"; do
            docker tag "$image" "$alias"
            docker push "$alias"
          done