cd.yml

name: Deploy

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*'

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write       # Create the GitHub Release
  packages: write       # Push to GHCR
  id-token: write       # OIDC for actions/attest-build-provenance
  attestations: write   # Persist the build provenance attestation

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  deploy:
    needs: ci
    environment: production
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Extract version
        id: version
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
          else
            echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"
          fi

      - name: Check tag does not exist
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        run: |
          if git ls-remote --tags origin | grep -q "refs/tags/v${{ steps.version.outputs.version }}$"; then
            echo "::error::Tag v${{ steps.version.outputs.version }} already exists. Run 'node scripts/bump-version.js' first."
            exit 1
          fi

      - name: Validate secrets
        env:
          HAS_VPS_HOST: ${{ secrets.VPS_HOST != '' }}
          HAS_VPS_USER: ${{ secrets.VPS_USER != '' }}
          HAS_VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY != '' }}
        run: |
          MISSING=""
          if [ "$HAS_VPS_HOST" != "true" ]; then MISSING="$MISSING VPS_HOST"; fi
          if [ "$HAS_VPS_USER" != "true" ]; then MISSING="$MISSING VPS_USER"; fi
          if [ "$HAS_VPS_SSH_KEY" != "true" ]; then MISSING="$MISSING VPS_SSH_KEY"; fi
          if [ -n "$MISSING" ]; then
            echo "::error::Missing required secrets:$MISSING — See docs/VPS_DEPLOY.md"
            exit 1
          fi

      - name: Log in to GHCR
        # Pinned by SHA — third-party action tags are mutable and can be hijacked.
        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Build and push
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:latest
            ghcr.io/${{ github.repository }}:${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: Generate SBOM (CycloneDX)
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          image: ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
          format: cyclonedx-json
          output-file: sbom.cdx.json
          upload-artifact: true

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Preflight — verify ~/.env.app on VPS
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          script: |
            set -e
            if [ ! -f "$HOME/.env.app" ]; then
              echo "::error::~/.env.app not found on VPS. Create it before deploying — see docs/VPS_DEPLOY.md section 5 (Set Up Production Environment)."
              exit 1
            fi
            if [ ! -r "$HOME/.env.app" ]; then
              echo "::error::~/.env.app exists but is not readable by $USER. Fix with: chmod 600 ~/.env.app"
              exit 1
            fi
            PERMS="$(stat -c '%a' "$HOME/.env.app" 2>/dev/null || stat -f '%Lp' "$HOME/.env.app")"
            # Warn (don't fail) if world-readable — users may have deliberate setups.
            # $PERMS is a digit string like "600" or "644"; force octal interpretation.
            if [ "$((8#$PERMS & 4))" -ne 0 ]; then
              echo "::warning::~/.env.app is world-readable (mode $PERMS). Recommend: chmod 600 ~/.env.app"
            fi
            echo "Preflight OK (mode $PERMS)"

      - name: Copy deploy script to VPS
        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          source: scripts/deploy-with-rollback.sh
          target: ~/app
          strip_components: 1

      - name: Deploy to VPS via SSH
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        env:
          # Pin by digest, not tag — guarantees the VPS pulls exactly what we just
          # built. A tag-based deploy can race a second concurrent build that
          # rewrites :latest / :<version> mid-rollout.
          IMAGE: ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
          PORT: ${{ secrets.APP_PORT || '3000' }}
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          envs: IMAGE,PORT
          script: |
            set -e
            chmod +x ~/app/deploy-with-rollback.sh
            IMAGE="$IMAGE" \
              PORT="$PORT" \
              DEPLOY_DIR="$HOME/app" \
              ENV_FILE="$HOME/.env.app" \
              ~/app/deploy-with-rollback.sh

      - name: Clean up old GHCR images
        uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
        continue-on-error: true
        with:
          package-name: ${{ github.event.repository.name }}
          package-type: container
          min-versions-to-keep: 10

      - name: Create GitHub Release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: v${{ steps.version.outputs.version }}
          generate_release_notes: true