deploy-prod.yml

name: Deploy to Prod

on:
  push:
    branches:
      - main

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up JDK 21
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Cache Gradle packages
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Build with Gradle
        run: |
          set -a
          source .env.example
          set +a
          unset JAVA_TOOL_OPTIONS
          ./gradlew bootJar -x test --build-cache -Dspring.profiles.active=prod

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: soundbar91/konect-prod
          tags: |
            type=raw,value=latest
            type=sha,prefix=sha-

      - name: Build and push Docker image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: .
          platforms: linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Backup prod MySQL before deploy
        env:
          DB_INSTANCE_ID: ${{ secrets.DB_INSTANCE_ID }}
        run: |
          set -euo pipefail

          COMMAND_ID=$(aws ssm send-command \
            --instance-ids "$DB_INSTANCE_ID" \
            --document-name "AWS-RunShellScript" \
            --comment "KONECT prod MySQL backup before deploy" \
            --parameters commands='[
              "bash -lc '\''START_TIME=$(date +%s); bash /home/ubuntu/konect/prod-db-compose/backup-db.sh; END_TIME=$(date +%s); echo \"Prod MySQL backup completed in $((END_TIME - START_TIME))s\"'\''"
            ]' \
            --query "Command.CommandId" \
            --output text)

          set +e
          aws ssm wait command-executed \
            --command-id "$COMMAND_ID" \
            --instance-id "$DB_INSTANCE_ID"
          WAITER_EXIT=$?
          set -e

          BACKUP_STATUS=$(aws ssm get-command-invocation \
            --command-id "$COMMAND_ID" \
            --instance-id "$DB_INSTANCE_ID" \
            --query "Status" \
            --output text)

          BACKUP_STATUS_DETAILS=$(aws ssm get-command-invocation \
            --command-id "$COMMAND_ID" \
            --instance-id "$DB_INSTANCE_ID" \
            --query "StatusDetails" \
            --output text)

          BACKUP_RESPONSE_CODE=$(aws ssm get-command-invocation \
            --command-id "$COMMAND_ID" \
            --instance-id "$DB_INSTANCE_ID" \
            --query "ResponseCode" \
            --output text)

          echo "Prod MySQL backup status: $BACKUP_STATUS (details: $BACKUP_STATUS_DETAILS, response-code: $BACKUP_RESPONSE_CODE)"

          if [ "$WAITER_EXIT" -ne 0 ] || [ "$BACKUP_STATUS" != "Success" ] || [ "$BACKUP_RESPONSE_CODE" != "0" ]; then
            echo "Prod MySQL backup failed. Remote stdout/stderr is intentionally not printed to avoid leaking sensitive information."
            exit 1
          fi

      - name: Deploy to prod server
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.PROD_SERVER_IP }}
          username: ${{ secrets.PROD_SERVER_USER }}
          key: ${{ secrets.PROD_SERVER_SSH_KEY }}
          port: ${{ secrets.PROD_SERVER_PORT }}
          script: |
            set -euo pipefail
            START_TIME=$(date +%s)

            cd ${{ secrets.PROD_WORK_DIR }}
            ./deploy.sh

            END_TIME=$(date +%s)
            echo "Prod deploy.sh completed in $((END_TIME - START_TIME))s"