traefik/.gitea/workflows/workflow.yaml

name: Remote Deployment Pipeline

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, closed]

env:
  # --- PATH CONFIGURATION ---
  REMOTE_DEPLOY_PATH: /var/app/traefik/test
  REMOTE_PROD_PATH: /var/app/traefik/prod
  REMOTE_STAGING_PATH: /var/app/traefik/staging
  REMOTE_PREPROD_PATH: /var/app/traefik/preprod

  # --- SECRETS ---
  SSH_HOST: ${{ secrets.SSH_HOST }}
  SSH_USER: ${{ secrets.SSH_USER }}
  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
  SSH_PORT: ${{ secrets.SSH_PORT || 22 }}

jobs:
  # ------------------------------------------------------------------
  # STAGE 1: PREPARE CONTEXT
  # ------------------------------------------------------------------
  prepare_context:
    name: Prepare Context
    runs-on: ubuntu-latest
    outputs:
      pr_path: ${{ steps.calc.outputs.pr_path }}
    steps:
      - id: calc
        name: Prepare Context
        run: |
          REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
          fi

  # ------------------------------------------------------------------
  # STAGE 2: DEPLOY PREVIEW (DEV)
  # ------------------------------------------------------------------
  deploy_preview:
    name: Deploy (Dev/Preview)
    runs-on: ubuntu-latest
    needs: [prepare_context]
    if: github.event_name == 'pull_request' && github.event.action != 'closed'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Deploy via Rsync & Docker
        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ needs.prepare_context.outputs.pr_path }}
          # Exclude git internals to save bandwidth
          EXCLUDE: ".git/, .github/"
          # 1. Create directory first
          SCRIPT_BEFORE: |
            mkdir -p ${{ needs.prepare_context.outputs.pr_path }}
          # 2. Run Docker Compose after sync
          SCRIPT_AFTER: |
            set -e
            cd ${{ needs.prepare_context.outputs.pr_path }}
            docker compose --env-file dev.env -f docker-compose.yaml -f docker-compose.dev.yaml up -d --build --remove-orphans --wait

  # ------------------------------------------------------------------
  # STAGE 3: DEPLOY STAGING
  # ------------------------------------------------------------------
  deploy_staging:
    name: Deploy (Staging)
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Deploy via Rsync & Docker
        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ env.REMOTE_STAGING_PATH }}
          EXCLUDE: ".git/, .github/"
          SCRIPT_BEFORE: |
            mkdir -p ${{ env.REMOTE_STAGING_PATH }}
          SCRIPT_AFTER: |
            set -e
            cd ${{ env.REMOTE_STAGING_PATH }}
            docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans --wait

  # ------------------------------------------------------------------
  # STAGE 3.5: DEPLOY PRE-PROD
  # ------------------------------------------------------------------
  deploy_preprod:
    name: Deploy (Pre-Prod)
    runs-on: ubuntu-latest
    needs: [deploy_staging]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Deploy via Rsync & Docker
        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ env.REMOTE_PREPROD_PATH }}
          EXCLUDE: ".git/, .github/"
          SCRIPT_BEFORE: |
            mkdir -p ${{ env.REMOTE_PREPROD_PATH }}
          SCRIPT_AFTER: |
            set -e
            cd ${{ env.REMOTE_PREPROD_PATH }}
            docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml -f docker-compose.preprod.yaml up -d --build --remove-orphans --wait

      - name: Run E2E Tests
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ env.SSH_HOST }}
          username: ${{ env.SSH_USER }}
          key: ${{ env.SSH_PRIVATE_KEY }}
          port: ${{ env.SSH_PORT }}
          script: |
            set -e
            cd ${{ env.REMOTE_PREPROD_PATH }}
            
            echo "Running E2E tests..."
            python3 -m venv .venv
            . .venv/bin/activate
            
            # Export env vars
            set -a
            . preprod.env
            set +a
            
            pip install -r tests/e2e/requirements.txt
            
            # Run tests
            if pytest tests/e2e/; then
              echo "Tests passed!"
              # Cleanup on success
              docker compose --env-file preprod.env -f docker-compose.yaml -f docker-compose.prod.yaml down --remove-orphans
            else
              echo "Tests failed!"
              # Optional: Cleanup on failure? Or keep for debugging?
              # User's previous script had it after, implying it runs if pytest succeeds (due to set -e).
              # I will fail the step.
              exit 1
            fi

  # ------------------------------------------------------------------
  # STAGE 4: DEPLOY PRODUCTION
  # ------------------------------------------------------------------
  deploy_prod:
    name: Deploy (Production)
    runs-on: ubuntu-latest
    needs: [deploy_preprod]
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Deploy via Rsync & Docker
        uses: easingthemes/ssh-deploy@2cc5b27bf3029d0455dd5e09fe02633904031447 # v6.0.3
        env:
          SSH_PRIVATE_KEY: ${{ env.SSH_PRIVATE_KEY }}
          REMOTE_HOST: ${{ env.SSH_HOST }}
          REMOTE_USER: ${{ env.SSH_USER }}
          REMOTE_PORT: ${{ env.SSH_PORT }}
          TARGET: ${{ env.REMOTE_PROD_PATH }}
          EXCLUDE: ".git/, .github/"
          SCRIPT_BEFORE: |
            mkdir -p ${{ env.REMOTE_PROD_PATH }}
          SCRIPT_AFTER: |
            set -e
            cd ${{ env.REMOTE_PROD_PATH }}
            docker compose --env-file prod.env -f docker-compose.yaml -f docker-compose.prod.yaml up -d --build --remove-orphans --wait

            # Run E2E Tests
            echo "Running E2E tests..."
            export CI=true
            # Create venv to avoid polluting system python
            python3 -m venv .venv
            . .venv/bin/activate
            # Export env vars so pytest can see them
            set -a
            . prod.env
            set +a
            pip install -r tests/e2e/requirements.txt
            pytest tests/e2e/

  # ------------------------------------------------------------------
  # CLEANUP (Using appleboy/ssh-action for pure command execution)
  # ------------------------------------------------------------------
  cleanup:
    name: Cleanup Preview
    runs-on: ubuntu-latest
    needs: [prepare_context]
    if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
    steps:
      - name: Remove Remote Environment
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        with:
          host: ${{ env.SSH_HOST }}
          username: ${{ env.SSH_USER }}
          key: ${{ env.SSH_PRIVATE_KEY }}
          port: ${{ env.SSH_PORT }}
          script: |
            TARGET="${{ needs.prepare_context.outputs.pr_path }}"
            if [ -d "$TARGET" ]; then
              cd "$TARGET"
              docker compose down -v || true
              cd ..
              rm -rf "$TARGET"
              echo "Cleanup successful"
            else
              echo "Directory not found, skipping."
            fi