deploy.yml

name: Deploy to VPS

on:
  workflow_run:
    workflows: ["Push CI"]
    branches: [main]
    types:
      - completed

permissions:
  contents: read

concurrency:
  group: deploy-${{ github.event.workflow_run.head_branch }}
  cancel-in-progress: false

jobs:
  deploy:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    env:
      DEPLOY_PATH: ${{ secrets.VPS_DEPLOY_PATH || '/opt/autocoder' }}
      TARGET_BRANCH: ${{ secrets.VPS_BRANCH || 'main' }}
      VPS_PORT: ${{ secrets.VPS_PORT || '22' }}
      DOMAIN: ${{ secrets.VPS_DOMAIN }}
      DUCKDNS_TOKEN: ${{ secrets.VPS_DUCKDNS_TOKEN }}
      LETSENCRYPT_EMAIL: ${{ secrets.VPS_LETSENCRYPT_EMAIL }}
      APP_PORT: ${{ secrets.VPS_APP_PORT || '8888' }}
      REPO_URL: https://github.com/${{ github.repository }}.git
      IMAGE_LATEST: ghcr.io/${{ github.repository }}:latest
      IMAGE_SHA: ghcr.io/${{ github.repository }}:${{ github.event.workflow_run.head_sha }}
    steps:
      - name: Deploy over SSH with Docker Compose
        uses: appleboy/ssh-action@v1.2.4
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          port: ${{ env.VPS_PORT }}
          envs: DEPLOY_PATH,TARGET_BRANCH,VPS_PORT,DOMAIN,DUCKDNS_TOKEN,LETSENCRYPT_EMAIL,APP_PORT,REPO_URL,IMAGE_LATEST,IMAGE_SHA
          script: |
            set -euo pipefail

            if [ -z "${DEPLOY_PATH:-}" ]; then
              echo "VPS_DEPLOY_PATH secret is required"; exit 1;
            fi

            if [ -z "${DOMAIN:-}" ] || [ -z "${DUCKDNS_TOKEN:-}" ] || [ -z "${LETSENCRYPT_EMAIL:-}" ]; then
              echo "VPS_DOMAIN, VPS_DUCKDNS_TOKEN, and VPS_LETSENCRYPT_EMAIL secrets are required."; exit 1;
            fi

            if [ ! -d "$DEPLOY_PATH/.git" ]; then
              echo "ERROR: $DEPLOY_PATH is missing a git repo. Clone the repository there and keep your .env file."; exit 1;
            fi

            cd "$DEPLOY_PATH"

            if [ ! -f ./deploy.sh ]; then
              echo "ERROR: deploy.sh not found in $DEPLOY_PATH. Ensure the repo is up to date."; exit 1;
            fi

            chmod +x ./deploy.sh

            if [ ! -f .env ]; then
              echo "WARNING: .env not found in $DEPLOY_PATH. Deployment will continue without it.";
            fi

            if [ "$(id -u)" -eq 0 ]; then
              RUNNER=""
            else
              if ! command -v sudo >/dev/null 2>&1; then
                echo "sudo is required to run deploy.sh as root."; exit 1;
              fi
              RUNNER="sudo"
            fi

            $RUNNER env \
              AUTOCODER_AUTOMATED=1 \
              AUTOCODER_ASSUME_YES=1 \
              DOMAIN="${DOMAIN}" \
              DUCKDNS_TOKEN="${DUCKDNS_TOKEN}" \
              LETSENCRYPT_EMAIL="${LETSENCRYPT_EMAIL}" \
              REPO_URL="${REPO_URL}" \
              DEPLOY_BRANCH="${TARGET_BRANCH}" \
              APP_DIR="${DEPLOY_PATH}" \
              APP_PORT="${APP_PORT}" \
              IMAGE="${IMAGE_SHA:-$IMAGE_LATEST}" \
              ./deploy.sh

            echo "Running smoke test on http://127.0.0.1:${APP_PORT}/health and /readiness ..."
            retries=12
            until curl -fsS --max-time 5 "http://127.0.0.1:${APP_PORT}/health" >/dev/null; do
              retries=$((retries - 1))
              if [ "$retries" -le 0 ]; then
                echo "Health check failed after retries."
                exit 1
              fi
              echo "Waiting for health... ($retries retries left)"
              sleep 5
            done

            retries=12
            until curl -fsS --max-time 5 "http://127.0.0.1:${APP_PORT}/readiness" >/dev/null; do
              retries=$((retries - 1))
              if [ "$retries" -le 0 ]; then
                echo "Readiness check failed after retries."
                exit 1
              fi
              echo "Waiting for readiness... ($retries retries left)"
              sleep 5
            done

            echo "Service responded successfully to health and readiness."