deploy.yml

name: Deploy

on:
  push:
    branches: [main]
    tags:
      - "v*"

env:
  AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}

jobs:
  # ── Build & push Docker images to ECR ─────────────────────────────────────
  build-and-push:
    name: Build & Push Images
    runs-on: ubuntu-latest
    outputs:
      backend_image: ${{ steps.meta-backend.outputs.tags }}
      tools_image:   ${{ steps.meta-tools.outputs.tags }}

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id:     ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region:            ${{ env.AWS_REGION }}

      - name: Log in to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2

      - name: Extract Docker metadata — backend
        id: meta-backend
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.ecr-login.outputs.registry }}/bioplatform-prod/backend
          tags: |
            type=sha,prefix=sha-
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Extract Docker metadata — tools
        id: meta-tools
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.ecr-login.outputs.registry }}/bioplatform-prod/tools
          tags: |
            type=sha,prefix=sha-
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push backend image
        uses: docker/build-push-action@v5
        with:
          context:   ./backend
          push:      true
          tags:      ${{ steps.meta-backend.outputs.tags }}
          labels:    ${{ steps.meta-backend.outputs.labels }}
          cache-from: type=gha
          cache-to:   type=gha,mode=max

      - name: Build and push tools image
        uses: docker/build-push-action@v5
        with:
          context:    ./backend
          file:       ./backend/Dockerfile.tools
          push:       true
          tags:       ${{ steps.meta-tools.outputs.tags }}
          labels:     ${{ steps.meta-tools.outputs.labels }}
          cache-from: type=gha
          cache-to:   type=gha,mode=max

  # ── Run Alembic migrations ─────────────────────────────────────────────────
  migrate:
    name: Run DB Migrations
    runs-on: ubuntu-latest
    needs: build-and-push
    # Only migrate on pushes to main (not on tags alone)
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id:     ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region:            ${{ env.AWS_REGION }}

      - name: Log in to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2

      - name: Run Alembic migrations via AWS Batch
        # Submits a one-off migration job to Batch.
        # Requires a 'migration' job definition registered in Batch that runs
        # `alembic upgrade head` against the production DATABASE_URL.
        run: |
          aws batch submit-job \
            --job-name "migrate-$(date +%Y%m%d%H%M%S)" \
            --job-queue "${{ vars.BATCH_JOB_QUEUE || 'bioplatform-prod-default' }}" \
            --job-definition "${{ vars.BATCH_MIGRATION_JOB_DEF || 'bioplatform-migration' }}" \
            --container-overrides '{
              "environment": [
                {"name": "DATABASE_URL", "value": "${{ secrets.DATABASE_URL }}"}
              ]
            }'
        # Note: In practice you may run migrations from a management instance
        # or ECS task rather than Batch — adjust as needed.

  # ── Deploy frontend (static build to S3 + CloudFront) ─────────────────────
  deploy-frontend:
    name: Deploy Frontend
    runs-on: ubuntu-latest
    needs: build-and-push
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install and build
        working-directory: frontend
        env:
          VITE_API_BASE_URL: ${{ vars.API_BASE_URL }}
        run: |
          npm ci
          npm run build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id:     ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region:            ${{ env.AWS_REGION }}

      - name: Upload to S3
        run: |
          aws s3 sync frontend/dist/ s3://${{ vars.FRONTEND_S3_BUCKET }}/ \
            --delete \
            --cache-control "public, max-age=31536000, immutable" \
            --exclude "index.html"

          # index.html: no-cache so users always get fresh entry point
          aws s3 cp frontend/dist/index.html s3://${{ vars.FRONTEND_S3_BUCKET }}/index.html \
            --cache-control "no-cache, no-store, must-revalidate"

      - name: Invalidate CloudFront cache
        if: vars.CLOUDFRONT_DISTRIBUTION_ID != ''
        run: |
          aws cloudfront create-invalidation \
            --distribution-id ${{ vars.CLOUDFRONT_DISTRIBUTION_ID }} \
            --paths "/*"