build-images.yml

name: Build, Push & Deploy

on:
  push:
    branches: [master]
    tags: ['v*']
    # No `paths:` filter — release-tag pushes are typically on
    # CHANGELOG-only commits and must still fire to produce
    # :<version>-tagged images. The script (scripts/build-images.sh)
    # does its own change detection and exits fast when nothing
    # service-relevant changed.
  workflow_dispatch:

jobs:
  build:
    runs-on: baumeister-runner
    steps:
      - name: Checkout repository
        run: |
          BEFORE="${{ github.event.before }}"
          if [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
            DEPTH=2
          else
            DEPTH=0
          fi
          if [ "$DEPTH" -eq 0 ]; then
            git clone --branch master \
              "https://oauth2:${GITHUB_TOKEN}@git.nuetzliche.it/nuts/powerbrain.git" workspace
          else
            git clone --depth "$DEPTH" --branch master \
              "https://oauth2:${GITHUB_TOKEN}@git.nuetzliche.it/nuts/powerbrain.git" workspace
          fi
          cd workspace

      - name: Login to Forgejo Registry
        run: |
          echo "${REGISTRY_PASSWORD}" | docker login git.nuetzliche.it -u "${REGISTRY_USER}" --password-stdin
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Detect and build changed images
        run: |
          cd workspace
          bash scripts/build-images.sh
        env:
          REGISTRY: git.nuetzliche.it
          ORG: nuts
          REPO: powerbrain
          FORCE_BUILD: ${{ github.event_name == 'workflow_dispatch' && 'true' || 'false' }}
          BEFORE_SHA: ${{ github.event.before }}
          # On tag pushes (refs/tags/v*), pass the tag name so the
          # script adds :<version> alongside :latest and :sha-<short>.
          # Empty for branch pushes; falls back to git describe.
          RELEASE_TAG: ${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || '' }}

      - name: Deploy — pull and restart services
        run: |
          DEPLOY_DIR="/opt/powerbrain"
          if [ ! -f "${DEPLOY_DIR}/docker-compose.yml" ]; then
            echo "⚠ ${DEPLOY_DIR}/docker-compose.yml not found — skipping deploy"
            exit 0
          fi

          cd "${DEPLOY_DIR}"
          # NOTE: `reranker` is profile-gated (`profiles: ["local-reranker"]`)
          # in docker-compose.yml. Naming it explicitly here would override
          # the profile gate and force-start it, even on deployments that
          # use a remote reranker (RERANKER_URL pointing at an external
          # endpoint). Operators who want the local reranker should bring
          # it up separately with `docker compose --profile local-reranker
          # up -d reranker`.
          docker compose pull mcp-server ingestion pb-proxy pb-worker
          docker compose up -d mcp-server ingestion pb-proxy pb-worker

          echo "✅ Powerbrain services restarted"

          for svc in pb-mcp-server pb-ingestion pb-proxy; do
            for i in $(seq 1 12); do
              status=$(docker inspect --format='{{.State.Health.Status}}' "$svc" 2>/dev/null || echo "unknown")
              if [ "$status" = "healthy" ]; then
                echo "✅ $svc healthy"
                break
              fi
              [ "$i" -eq 12 ] && echo "⚠ $svc not healthy after 60s"
              sleep 5
            done
          done