cd-dev.yml

name: CD (dev)

on:
  push:
    branches: [develop]

jobs:
  deploy:
    concurrency:
      group: cd-dev
      cancel-in-progress: false
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Detect direct push
        id: push-source
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          MERGED_PR_COUNT=$(
            curl --fail --silent --show-error --location \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer $GH_TOKEN" \
              -H "X-GitHub-Api-Version: 2026-03-10" \
              "https://api.github.com/repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" |
              jq --arg branch "$GITHUB_REF_NAME" \
                '[.[] | select(.merged_at != null and .base.ref == $branch)] | length'
          )
          if [ "$MERGED_PR_COUNT" -eq 0 ]; then
            echo "direct_push=true" >> "$GITHUB_OUTPUT"
            echo "Direct push detected: CI will run before deployment."
          else
            echo "direct_push=false" >> "$GITHUB_OUTPUT"
            echo "Merged pull request detected: using the completed PR CI result."
          fi

      - name: Checkout config submodule
        env:
          SUBMODULE_PAT: ${{ secrets.SUBMODULE_PAT }}
        run: |
          if [ -z "$SUBMODULE_PAT" ]; then
            echo "Missing required secret: SUBMODULE_PAT"
            exit 1
          fi
          AUTH_HEADER=$(printf 'x-access-token:%s' "$SUBMODULE_PAT" | base64 | tr -d '\n')
          git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $AUTH_HEADER" submodule update --init --recursive

      - name: Set up JDK 25
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: temurin
          java-version: '25'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Resolve application version
        run: |
          chmod +x gradlew
          APP_VERSION=$(./gradlew -q printVersion)
          SHORT_SHA=${GITHUB_SHA::12}
          echo "APP_VERSION=$APP_VERSION" >> "$GITHUB_ENV"
          echo "APP_IMAGE_TAG=${APP_VERSION}-dev-${SHORT_SHA}" >> "$GITHUB_ENV"

      - name: Build and test direct push
        if: ${{ steps.push-source.outputs.direct_push == 'true' }}
        run: |
          chmod +x gradlew
          ./gradlew build

      - name: Build bootJar
        run: |
          chmod +x gradlew
          ./gradlew :app:bootJar

      - name: Set up Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to GHCR
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & push versioned image (arm64)
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/arm64
          push: true
          tags: |
            ghcr.io/nalssilog/api:dev
            ghcr.io/nalssilog/api:${{ env.APP_IMAGE_TAG }}
            ghcr.io/nalssilog/api:sha-${{ github.sha }}
          build-args: |
            APP_VERSION=${{ env.APP_VERSION }}
            VCS_REF=${{ github.sha }}

      - name: Open SSH (add runner IP to SG)
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
        run: |
          IP=$(curl -s https://checkip.amazonaws.com)
          echo "RUNNER_IP=$IP" >> "$GITHUB_ENV"
          aws ec2 authorize-security-group-ingress --group-id "${{ secrets.AWS_SG_ID }}" --protocol tcp --port 22 --cidr "$IP/32"

      - name: Copy compose + config to EC2
        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
        with:
          host: ${{ secrets.EC2_HOST_DEV }}
          username: ${{ secrets.EC2_USER_DEV }}
          key: ${{ secrets.EC2_SSH_KEY_DEV }}
          source: "deploy/compose-dev.yml"
          target: /home/ubuntu/nalssilog-dev-api
          strip_components: 1

      - name: Copy config (submodule) to EC2
        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
        with:
          host: ${{ secrets.EC2_HOST_DEV }}
          username: ${{ secrets.EC2_USER_DEV }}
          key: ${{ secrets.EC2_SSH_KEY_DEV }}
          source: "config/"
          target: /home/ubuntu/nalssilog-dev-api/config
          strip_components: 1

      - name: Write .env.dev & deploy on EC2
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        env:
          APP_VERSION: ${{ env.APP_VERSION }}
          APP_IMAGE_TAG: ${{ env.APP_IMAGE_TAG }}
          GHCR_USERNAME: ${{ github.actor }}
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DB_HOST: ${{ secrets.DEV_DB_HOST }}
          DB_PORT: ${{ secrets.DEV_DB_PORT }}
          DB_NAME: ${{ secrets.DEV_DB_NAME }}
          DB_USERNAME: ${{ secrets.DEV_DB_USERNAME }}
          DB_PASSWORD: ${{ secrets.DEV_DB_PASSWORD }}
          APPLE_CLIENT_ID: ${{ secrets.DEV_OAUTH_APPLE_CLIENT_ID }}
          APPLE_TEAM_ID: ${{ secrets.DEV_OAUTH_APPLE_TEAM_ID }}
          APPLE_KEY_ID: ${{ secrets.DEV_OAUTH_APPLE_KEY_ID }}
          APPLE_PRIVATE_KEY_BASE64: ${{ secrets.DEV_OAUTH_APPLE_PRIVATE_KEY_BASE64 }}
          DEV_R2_PUBLIC_BASE_URL: ${{ secrets.DEV_R2_PUBLIC_BASE_URL }}
          DEV_R2_ENDPOINT: ${{ secrets.DEV_R2_ENDPOINT }}
          DEV_R2_BUCKET: ${{ secrets.DEV_R2_BUCKET }}
          DEV_R2_ACCESS_KEY: ${{ secrets.DEV_R2_ACCESS_KEY }}
          DEV_R2_SECRET_KEY: ${{ secrets.DEV_R2_SECRET_KEY }}
        with:
          host: ${{ secrets.EC2_HOST_DEV }}
          username: ${{ secrets.EC2_USER_DEV }}
          key: ${{ secrets.EC2_SSH_KEY_DEV }}
          envs: APP_VERSION,APP_IMAGE_TAG,GHCR_USERNAME,GHCR_TOKEN,DB_HOST,DB_PORT,DB_NAME,DB_USERNAME,DB_PASSWORD,APPLE_CLIENT_ID,APPLE_TEAM_ID,APPLE_KEY_ID,APPLE_PRIVATE_KEY_BASE64,DEV_R2_PUBLIC_BASE_URL,DEV_R2_ENDPOINT,DEV_R2_BUCKET,DEV_R2_ACCESS_KEY,DEV_R2_SECRET_KEY
          script: |
            set -eu
            cd /home/ubuntu/nalssilog-dev-api
            for name in APP_VERSION APP_IMAGE_TAG GHCR_USERNAME GHCR_TOKEN DB_HOST DB_PORT DB_NAME DB_USERNAME DB_PASSWORD DEV_R2_PUBLIC_BASE_URL DEV_R2_ENDPOINT DEV_R2_BUCKET DEV_R2_ACCESS_KEY DEV_R2_SECRET_KEY; do
              if [ -z "$(printenv "$name")" ]; then
                echo "Missing required deployment value: $name"
                exit 1
              fi
            done
            APPLE_VALUE_COUNT=0
            for name in APPLE_CLIENT_ID APPLE_TEAM_ID APPLE_KEY_ID APPLE_PRIVATE_KEY_BASE64; do
              if [ -n "$(printenv "$name" 2>/dev/null || true)" ]; then
                APPLE_VALUE_COUNT=$((APPLE_VALUE_COUNT + 1))
              fi
            done
            if [ "$APPLE_VALUE_COUNT" -ne 0 ] && [ "$APPLE_VALUE_COUNT" -ne 4 ]; then
              echo "Apple OAuth secrets must be configured all together."
              exit 1
            fi
            ACTIVE_PROFILES=dev
            if [ "$APPLE_VALUE_COUNT" -eq 4 ]; then
              ACTIVE_PROFILES=dev,apple
            fi
            export SPRING_PROFILES_ACTIVE=$ACTIVE_PROFILES
            umask 077
            cat > .env.dev <<EOF
            APP_VERSION=$APP_VERSION
            APP_IMAGE_TAG=$APP_IMAGE_TAG
            SPRING_PROFILES_ACTIVE=$ACTIVE_PROFILES
            DEV_DB_URL=jdbc:postgresql://$DB_HOST:$DB_PORT/$DB_NAME?sslmode=require
            DEV_DB_USERNAME=$DB_USERNAME
            DEV_DB_PASSWORD=$DB_PASSWORD
            OAUTH_APPLE_CLIENT_ID=${APPLE_CLIENT_ID:-}
            OAUTH_APPLE_TEAM_ID=${APPLE_TEAM_ID:-}
            OAUTH_APPLE_KEY_ID=${APPLE_KEY_ID:-}
            OAUTH_APPLE_PRIVATE_KEY_BASE64=${APPLE_PRIVATE_KEY_BASE64:-}
            DEV_R2_PUBLIC_BASE_URL=$DEV_R2_PUBLIC_BASE_URL
            DEV_R2_ENDPOINT=$DEV_R2_ENDPOINT
            DEV_R2_BUCKET=$DEV_R2_BUCKET
            DEV_R2_ACCESS_KEY=$DEV_R2_ACCESS_KEY
            DEV_R2_SECRET_KEY=$DEV_R2_SECRET_KEY
            EOF
            mkdir -p logs
            sudo chown 10001:10001 logs
            sudo chmod 0755 logs
            echo "$GHCR_TOKEN" | docker login ghcr.io --username "$GHCR_USERNAME" --password-stdin
            trap 'docker logout ghcr.io >/dev/null 2>&1 || true' EXIT
            docker compose --env-file .env.dev -f compose-dev.yml pull
            docker compose --env-file .env.dev -f compose-dev.yml up -d
            healthy=false
            for attempt in $(seq 1 30); do
              if curl --fail --silent --max-time 3 http://127.0.0.1:8080/api/health >/dev/null; then
                healthy=true
                break
              fi
              if [ "$(docker inspect -f '{{.State.Running}}' nalssilog-app-dev 2>/dev/null || echo false)" != "true" ]; then
                break
              fi
              sleep 2
            done
            if [ "$healthy" != "true" ]; then
              echo "Dev application health check failed"
              docker logs --tail 200 nalssilog-app-dev || true
              exit 1
            fi
            docker image prune -f

      - name: Close SSH (revoke runner IP)
        if: always()
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
        run: |
          aws ec2 revoke-security-group-ingress --group-id "${{ secrets.AWS_SG_ID }}" --protocol tcp --port 22 --cidr "$RUNNER_IP/32" || true