name: Test & Deploy

on:

  push:

    branches:

      - master

      - production

    paths:

      - 'api/**'

      - '.github/workflows/deploy.yml'

  pull_request:

    paths:

      - 'api/**'

      - '.github/workflows/deploy.yml'

env:

  REGISTRY: ghcr.io

  IMAGE_NAME: ${{ github.repository }}

jobs:

  test:

    name: Run test suite

    runs-on: ubuntu-latest

    services:

      postgres:

        image: postgres:17-alpine

        env:

          POSTGRES_USER: user

          POSTGRES_PASSWORD: password

          POSTGRES_DB: postgres

        options: >-

          --health-cmd "pg_isready -U user"

          --health-interval 10s

          --health-timeout 5s

          --health-retries 5

        ports:

          - 5432:5432

    defaults:

      run:

        working-directory: api

    env:

      DATABASE_URL: postgres://user:password@localhost:5432/orbit_test

      NODE_ENV: test

      JWT_SECRET: test-secret-key

      FRONTEND_URL: http://localhost:8081

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4

        with:

          node-version: '24'

          cache: 'npm'

          cache-dependency-path: api/package-lock.json

      - name: Install dependencies

        run: npm ci

      - name: Set up test database

        run: |

          node scripts/create-test-db.mjs

          npx prisma generate

          npx prisma db push

      - name: Typecheck (advisory)

        run: |

          npm run typecheck || echo "::warning title=API typecheck::tsc reported errors (advisory, see log above)"

      - name: Run tests

        run: npx vitest run

  build-and-push:

    name: Build & push image

    needs: test

    if: github.event_name == 'push'

    runs-on: ubuntu-latest

    permissions:

      contents: read

      packages: write

    outputs:

      image_tag: ${{ steps.meta.outputs.version }}

    steps:

      - name: Checkout

        uses: actions/checkout@v4

      - name: Log in to GHCR

        uses: docker/login-action@v3

        with:

          registry: ${{ env.REGISTRY }}

          username: ${{ github.actor }}

          password: ${{ secrets.GHCR_TOKEN }}

      - name: Docker metadata

        id: meta

        uses: docker/metadata-action@v5

        with:

          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

          tags: |

            # main branch => tag "latest"

            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}

            # production branch => tag "production"

            # type=raw,value=production,enable=${{ github.ref == 'refs/heads/production' }}

            # always tag with short SHA for traceability

            type=sha,prefix=,format=short

      - name: Build and push

        uses: docker/build-push-action@v5

        with:

          context: ./api

          file: ./api/Dockerfile.production

          push: true

          tags: ${{ steps.meta.outputs.tags }}

          labels: ${{ steps.meta.outputs.labels }}

  deploy-production:

    name: Deploy to production

    needs: build-and-push

    runs-on: ubuntu-latest

    if: github.ref == 'refs/heads/master'

    environment: production

    steps:

      - name: Deploy via SSH

        uses: appleboy/ssh-action@v1

        with:

          host: ${{ secrets.VPS_HOST }}

          username: ${{ secrets.VPS_USER }}

          key: ${{ secrets.VPS_SSH_KEY }}

          script: |

            set -e

            cd /srv/app/production

            docker pull ghcr.io/${{ github.repository }}:latest

            sed -i "s/^IMAGE_TAG=.*/IMAGE_TAG=latest/" .env

            docker compose up -d --no-deps --force-recreate api

            # old image layers pile up across deploys; keep roughly the last week

            docker image prune -af --filter "until=168h" >/dev/null 2>&1 || true

            sleep 5

            docker compose logs --tail=50 api