deploy-prod.yaml

name: Deploy to Production

on:
  workflow_dispatch:

jobs:
  # Sync dev branch to main before deployment
  sync-dev-to-main:
    runs-on: ubuntu-latest
    if: ${{ contains(fromJson(vars.PROD_DEPLOYMENT_ALLOWED_USERS), github.actor) }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Fetch all branches
        run: |
          git fetch origin dev
          git fetch origin main

      - name: Checkout main branch
        run: git checkout main

      - name: Merge dev into main
        run: |
          git merge --ff-only origin/dev || {
            echo "❌ Fast-forward merge failed. Manual conflict resolution required."
            echo "Please ensure dev branch is ahead of main with no conflicts."
            git merge --abort
            exit 1
          }

      - name: Push updated main branch
        run: git push origin main

  # Build and push Docker images
  push-to-dockerhub:
    runs-on: ubuntu-latest
    needs: sync-dev-to-main
    if: ${{ contains(fromJson(vars.PROD_DEPLOYMENT_ALLOWED_USERS), github.actor) }}
    env:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Check Docker credentials
        run: |
          if [ -z "${{ secrets.DOCKER_USERNAME }}" ] || [ -z "${{ secrets.DOCKER_PASSWORD }}" ]; then
            echo "❌ Docker credentials missing, skipping Docker Hub push"
            exit 1
          fi

      - name: Get short commit hash
        id: vars
        run: echo "tag=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and tag image
        run: |
          docker build . --tag ${{ secrets.DOCKER_USERNAME }}/pesu-auth:${{ steps.vars.outputs.tag }}
          docker tag ${{ secrets.DOCKER_USERNAME }}/pesu-auth:${{ steps.vars.outputs.tag }} ${{ secrets.DOCKER_USERNAME }}/pesu-auth:latest

      - name: Push image to Docker Hub
        run: |
          docker push ${{ secrets.DOCKER_USERNAME }}/pesu-auth:${{ steps.vars.outputs.tag }}
          docker push ${{ secrets.DOCKER_USERNAME }}/pesu-auth:latest

  # Push to GitHub Container Registry
  push-to-ghcr:
    runs-on: ubuntu-latest
    needs: sync-dev-to-main
    if: ${{ contains(fromJson(vars.PROD_DEPLOYMENT_ALLOWED_USERS), github.actor) }}
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Get short commit hash
        id: vars
        run: echo "tag=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and tag image for GHCR
        run: |
          docker build . --tag ghcr.io/${{ github.repository_owner }}/pesu-auth:${{ steps.vars.outputs.tag }}
          docker tag ghcr.io/${{ github.repository_owner }}/pesu-auth:${{ steps.vars.outputs.tag }} ghcr.io/${{ github.repository_owner }}/pesu-auth:latest

      - name: Push image to GitHub Container Registry
        run: |
          docker push ghcr.io/${{ github.repository_owner }}/pesu-auth:${{ steps.vars.outputs.tag }}
          docker push ghcr.io/${{ github.repository_owner }}/pesu-auth:latest

  # Deploy to Staging
  deploy-to-staging:
    runs-on: ubuntu-latest
    needs: [sync-dev-to-main, push-to-dockerhub, push-to-ghcr]
    if: ${{ contains(fromJson(vars.PROD_DEPLOYMENT_ALLOWED_USERS), github.actor) }}
    env:
      RENDER_DEPLOY_HOOK_URL_DEV: ${{ secrets.RENDER_DEPLOY_HOOK_URL_DEV }}
    steps:
      - name: Check Staging Deploy Hook URL
        run: |
          if [ -z "${{ secrets.RENDER_DEPLOY_HOOK_URL_DEV }}" ]; then
            echo "❌ Staging deploy hook missing!"
            exit 1
          fi

      - name: Deploy to Staging
        run: |
          echo "🚀 Deploying to Staging..."
          curl -X POST ${{ secrets.RENDER_DEPLOY_HOOK_URL_DEV }} || {
            echo "❌ Staging deploy failed!"
            exit 1
          }
          echo "✅ Staging deployment completed successfully!"

  # Deploy to Production
  deploy-to-prod:
    runs-on: ubuntu-latest
    needs: [sync-dev-to-main, push-to-dockerhub, push-to-ghcr, deploy-to-staging]
    if: ${{ contains(fromJson(vars.PROD_DEPLOYMENT_ALLOWED_USERS), github.actor) }}
    env:
      RENDER_DEPLOY_HOOK_URL_PROD: ${{ secrets.RENDER_DEPLOY_HOOK_URL_PROD }}
    steps:
      - name: Check Production Deploy Hook URL
        run: |
          if [ -z "${{ secrets.RENDER_DEPLOY_HOOK_URL_PROD }}" ]; then
            echo "❌ Production deploy hook missing!"
            exit 1
          fi

      - name: Deploy to Production
        run: |
          echo "🚀 Deploying to Production..."
          curl -X POST ${{ secrets.RENDER_DEPLOY_HOOK_URL_PROD }} || {
            echo "❌ Production deploy failed!"
            exit 1
          }
          echo "✅ Production deployment completed successfully!"

      - name: Deployment Summary
        run: |
          echo "🎉 All deployments completed successfully!"
          echo "✅ Branch sync: dev → main"
          echo "✅ Docker images: pushed to Docker Hub and GHCR"
          echo "✅ Staging: deployed"
          echo "✅ Production: deployed"