deploy.yml

name: Deploy to DigitalOcean
run-name: Deploy to DigitalOcean (${{ github.ref_name }})

on:
  push:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  RUBY_VERSION: '4.0.1'
  NODE_VERSION: '24'
  POSTGRES_VERSION: '18'
  REDIS_VERSION: '8'
  REGISTRY: ghcr.io

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    
    services:
      postgres:
        image: postgres:18
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: streamsource_test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
      
      redis:
        image: redis:8
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    steps:
    - name: Checkout code
      uses: actions/checkout@v5
      with:
        fetch-depth: 0  # Full history for better caching
    
    - name: Cache Ruby dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.bundle
          vendor/bundle
        key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
        restore-keys: |
          ${{ runner.os }}-gems-

    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: ${{ env.RUBY_VERSION }}
        bundler-cache: true
    
    - name: Cache Node dependencies
      uses: actions/cache@v4
      with:
        path: |
          ~/.cache/yarn
          node_modules
        key: ${{ runner.os }}-node-${{ hashFiles('**/yarn.lock') }}
        restore-keys: |
          ${{ runner.os }}-node-

    - name: Setup Node
      uses: actions/setup-node@v6
      with:
        node-version: ${{ env.NODE_VERSION }}
        cache: 'yarn'
    
    - name: Install dependencies
      run: |
        yarn install --frozen-lockfile --prefer-offline
    
    - name: Setup test database
      env:
        RAILS_ENV: test
        DATABASE_URL: postgres://postgres:postgres@localhost:5432/streamsource_test
        REDIS_URL: redis://localhost:6379/1
      run: |
        bundle exec rails db:create
        bundle exec rails db:schema:load
    
    - name: Run tests
      env:
        RAILS_ENV: test
        DATABASE_URL: postgres://postgres:postgres@localhost:5432/streamsource_test
        REDIS_URL: redis://localhost:6379/1
      run: bundle exec rspec
    
    - name: Run security checks
      run: |
        echo "🔍 Running security analysis..."
        
        # Static Application Security Testing (SAST)
        bundle exec brakeman -q -w2 --format json --output brakeman-report.json
        
        # Dependency vulnerability scanning
        bundle exec bundler-audit check --update --format json --output bundler-audit-report.json
        
        # Display results
        echo "Brakeman security scan completed"
        if [ -f brakeman-report.json ]; then
          echo "Brakeman found $(jq '.warnings | length' brakeman-report.json) potential issues"
        fi
        
        echo "Bundler audit completed"
        if [ -f bundler-audit-report.json ]; then
          echo "Bundler audit found $(jq '.vulnerabilities | length' bundler-audit-report.json) vulnerabilities"
        fi
    
    - name: Upload security reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: security-reports
        path: |
          brakeman-report.json
          bundler-audit-report.json
        retention-days: 30

  deploy:
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    timeout-minutes: 20
    environment:
      name: production
      url: https://${{ vars.DROPLET_HOST }}
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v5

    - name: Set image name
      id: image
      run: echo "name=${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to GHCR
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract Docker metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}
        tags: |
          type=sha,format=long
          type=raw,value=latest

    - name: Build and push image
      uses: docker/build-push-action@v6
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
    
    - name: Deploy to DigitalOcean
      id: deploy
      uses: appleboy/ssh-action@v1.2.2
      with:
        host: ${{ secrets.DROPLET_HOST }}
        username: deploy
        key: ${{ secrets.DEPLOY_SSH_KEY }}
        timeout: 900s
        script: |
          set -e
          cd /var/www/streamsource
          export STREAMSOURCE_IMAGE="${{ env.REGISTRY }}/${{ steps.image.outputs.name }}:sha-${{ github.sha }}"
          export STREAMSOURCE_ENV_FILE="/var/www/streamsource/.env.production"
          
          echo "🚀 Pulling image ${STREAMSOURCE_IMAGE}..."
          docker compose -f docker-compose.yml -f docker-compose.prod.yml pull web
          docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d web
          echo "✅ Deployment completed successfully"

    - name: Comprehensive health check
      run: |
        echo "🏥 Running comprehensive health checks..."
        
        # Wait for application to stabilize
        sleep 30
        
        # Test multiple endpoints
        echo "Testing basic health endpoint..."
        curl -f -s https://${{ secrets.DROPLET_HOST }}/health || exit 1
        
        echo "Testing database connectivity..."
        curl -f -s https://${{ secrets.DROPLET_HOST }}/health/db || exit 1
        
        echo "Testing Redis connectivity..."
        curl -f -s https://${{ secrets.DROPLET_HOST }}/health/redis || exit 1
        
        echo "Testing application responsiveness..."
        RESPONSE_TIME=$(curl -w "%{time_total}" -s -o /dev/null https://${{ secrets.DROPLET_HOST }}/health)
        echo "Response time: ${RESPONSE_TIME}s"
        
        # Fail if response time is too slow (> 5 seconds)
        if (( $(echo "$RESPONSE_TIME > 5.0" | bc -l) )); then
          echo "❌ Application is responding too slowly ($RESPONSE_TIME seconds)"
          exit 1
        fi
        
        echo "✅ All health checks passed"
    
    - name: Rollback on failure
      if: failure() && steps.deploy.conclusion == 'failure'
      uses: appleboy/ssh-action@v1.2.2
      with:
        host: ${{ secrets.DROPLET_HOST }}
        username: deploy
        key: ${{ secrets.DEPLOY_SSH_KEY }}
        script: |
          cd /var/www/streamsource
          echo "🔄 Initiating automatic rollback..."
          ./deploy/rollback.sh
          echo "✅ Rollback completed"
      continue-on-error: true

    - name: Notify deployment status
      if: always()
      uses: 8398a7/action-slack@v3
      with:
        status: ${{ job.status }}
        webhook_url: ${{ secrets.SLACK_WEBHOOK }}
        text: |
          StreamSource deployment ${{ job.status }}
          
          📋 *Deployment Details:*
          • Commit: `${{ github.sha }}`
          • Branch: `${{ github.ref_name }}`
          • Author: ${{ github.actor }}
          • Workflow: ${{ github.workflow }}
          
          ${{ job.status == 'success' && '✅ Deployment successful!' || '❌ Deployment failed - automatic rollback initiated' }}
          
          🔗 [View Workflow Run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
      continue-on-error: true

    - name: Record deployment metrics
      if: always()
      run: |
        echo "📊 Recording deployment metrics..."
        
        # Create deployment record
        curl -X POST "https://api.github.com/repos/${{ github.repository }}/deployments" \
          -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
          -H "Content-Type: application/json" \
          -d '{
            "ref": "${{ github.sha }}",
            "environment": "production",
            "description": "Deployment via GitHub Actions",
            "auto_merge": false
          }' || echo "Failed to record deployment"
        
        echo "✅ Deployment metrics recorded"