traefik/.gitea/workflows/workflow.yaml

name: Remote Deployment Pipeline

on:
  push:
    branches:
      - main
      - legacy-network-restriction
  pull_request:
    types: [opened, synchronize, reopened, closed]

env:
  # --- PATH CONFIGURATION ---
  REMOTE_DEPLOY_PATH: /var/app/traefik/test
  REMOTE_PROD_PATH: /var/app/traefik/prod
  REMOTE_STAGING_PATH: /var/app/traefik/staging

  # --- SECRETS ---
  SSH_HOST: ${{ secrets.SSH_HOST }}
  SSH_USER: ${{ secrets.SSH_USER }}
  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}

jobs:
  # ------------------------------------------------------------------
  # STAGE 1: PREPARE
  # Calculate dynamic paths (like PR folders) so other jobs can use them
  # ------------------------------------------------------------------
  prepare_context:
    name: Prepare Context
    runs-on: ubuntu-latest
    outputs:
      pr_path: ${{ steps.calc.outputs.pr_path }}
    steps:
      - id: calc
        run: |
          REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
          # Only needed for PRs
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
          fi

  # ------------------------------------------------------------------
  # STAGE 2: DEPLOY PREVIEW (DEV)
  # Runs only on Pull Requests
  # ------------------------------------------------------------------
  deploy_preview:
    name: Deploy (Dev/Preview)
    runs-on: ubuntu-latest
    needs: prepare_context
    if: github.event_name == 'pull_request' && github.event.action != 'closed'
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }

      - name: Sync & Build
        run: |
          # 1. Setup Known Hosts
          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
          
          # 2. Define Target
          TARGET="${{ needs.prepare_context.outputs.pr_path }}"
          
          # 3. Create Remote Dir
          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"

          # 4. Sync Files (Exclude .git to save bandwidth)
          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
            --exclude '.git/' --exclude '.github/' \
            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/

          # 5. Build and Run on Server
          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
            cd '$TARGET'
            docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
          "

  # ------------------------------------------------------------------
  # STAGE 3: DEPLOY STAGING
  # Runs on 'main'. Always runs before Prod.
  # ------------------------------------------------------------------
  deploy_staging:
    name: Deploy (Staging)
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }

      - name: Sync & Build
        run: |
          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
          
          TARGET="${{ env.REMOTE_STAGING_PATH }}"
          
          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"

          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
            --exclude '.git/' --exclude '.github/' \
            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/

          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
            cd '$TARGET'
            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans
          "

  # ------------------------------------------------------------------
  # STAGE 4: DEPLOY PRODUCTION
  # Runs on 'main'. DEPENDS ON STAGING SUCCESS.
  # ------------------------------------------------------------------
  deploy_prod:
    name: Deploy (Production)
    runs-on: ubuntu-latest
    needs: deploy_staging # <--- This is the key logic separation
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - uses: webfactory/ssh-agent@v0.9.0
        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }

      - name: Sync & Build
        run: |
          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
          
          TARGET="${{ env.REMOTE_PROD_PATH }}"
          
          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"

          rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
            --exclude '.git/' --exclude '.github/' \
            ./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/

          # Note: Since Staging just built this commit on the same server, 
          # this build step will be nearly instant (using Docker cache).
          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
            cd '$TARGET'
            docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
          "

  # ------------------------------------------------------------------
  # CLEANUP (On PR Close)
  # ------------------------------------------------------------------
  cleanup:
    name: Cleanup Preview
    runs-on: ubuntu-latest
    needs: prepare_context
    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
    steps:
      - uses: webfactory/ssh-agent@v0.9.0
        with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }

      - name: Remove Remote Environment
        run: |
          mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
          
          TARGET="${{ needs.prepare_context.outputs.pr_path }}"
          
          ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
            if [ -d '$TARGET' ]; then
              cd '$TARGET'
              docker compose down -v || true
              cd ..
              rm -rf '$TARGET'
              echo 'Cleanup successful'
            else
              echo 'Directory not found, skipping.'
            fi
          "