deploy.yml

name: payNEXT CI/CD

on:
  push:
    branches: [devs, release, main]
  pull_request:
    branches: [release, main]
  workflow_dispatch:

concurrency:
  group: paynext-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  validate:
    name: Validate Project
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check required files
        run: |
          test -f docker-compose.yml
          test -f web/Dockerfile
          test -f web/nginx.conf
          test -f web/public/index.html
          test -f db/init.sql

      - name: Create dummy .env file
        run: echo "JWT_SECRET=super_secret_test_key" > .env

      - name: Validate Docker Compose file
        run: docker compose -f docker-compose.yml config > /dev/null

  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: validate
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      env:
      SERVER_IP: ${{ secrets.SERVER_IP }}
      SSH_USER: ${{ secrets.SSH_USER }}
      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
      DB_HOST: ${{ secrets.DB_HOST }}
      DB_USER: ${{ secrets.DB_USER }}
      DB_NAME: ${{ secrets.DB_NAME }}
      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
      JWT_SECRET: ${{ secrets.JWT_SECRET }}
    steps:
      - uses: actions/checkout@v4

      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
          chmod 700 ~/.ssh
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -H "$SERVER_IP" >> ~/.ssh/known_hosts

      - name: Create deployment folder on server
        run: ssh "$SSH_USER@$SERVER_IP" "mkdir -p /opt/paynext"

      - name: Build server .env on the runner
        run: |
          {
            echo "DB_HOST=$DB_HOST"
            echo "DB_PORT=5432"
            echo "DB_USER=$DB_USER"
            echo "DB_PASSWORD=$DB_PASSWORD"
            echo "DB_NAME=$DB_NAME"
            echo "DB_SSL=true"
            echo "JWT_SECRET=$JWT_SECRET"
          } > server.env

      - name: Copy app and .env to server
        run: |
          tar --exclude='./.git' --exclude='./.github' -czf paynext.tgz docker-compose.yml web db
          scp paynext.tgz "$SSH_USER@$SERVER_IP":/tmp/paynext.tgz
          scp server.env "$SSH_USER@$SERVER_IP":/opt/paynext/.env
          rm -f server.env paynext.tgz

      - name: Deploy using Docker
        run: |
          ssh "$SSH_USER@$SERVER_IP" << 'EOF'
          set -e
          cd /opt/paynext
          docker compose down --remove-orphans || true
          rm -rf web db docker-compose.yml
          tar -xzf /tmp/paynext.tgz
          rm -f /tmp/paynext.tgz
          docker compose up -d --build
          docker image prune -f
          EOF