MokoGitea/.mokogitea/workflows/deploy-mokogitea.yml

# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
#
# SPDX-License-Identifier: GPL-3.0-or-later
#
# FILE INFORMATION
# DEFGROUP: Gitea.Workflow
# INGROUP: MokoGitea.Deploy
# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoGitea
# PATH: /.mokogitea/workflows/deploy-mokogitea.yml
# BRIEF: Build MokoGitea Docker image and deploy to production
#
# +========================================================================+
# |                    MOKOGITEA DEPLOY PIPELINE                           |
# +========================================================================+
# |                                                                        |
# |  Triggers:                                                             |
# |    - Manual dispatch (workflow_dispatch) with version tag              |
# |    - Push to main with [deploy] in commit message                     |
# |                                                                        |
# |  Steps:                                                                |
# |    1. Checkout source                                                  |
# |    2. Build frontend assets (node/pnpm)                               |
# |    3. Build Go backend binary                                         |
# |    4. Build Docker image                                              |
# |    5. Push to Gitea container registry                                |
# |    6. SSH to production, update compose, restart                      |
# |                                                                        |
# +========================================================================+

name: Deploy MokoGitea

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag (e.g. v05.00.00)'
        required: true
        default: 'latest'
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'templates/**'
      - 'web_src/**'
      - 'options/**'
      - 'Dockerfile'
      - 'Makefile'

concurrency:
  group: deploy-mokogitea
  cancel-in-progress: false

env:
  REGISTRY: git.mokoconsulting.tech
  IMAGE: mokoconsulting/mokogitea
  DEPLOY_HOST: git.mokoconsulting.tech
  DEPLOY_PORT: 2918
  DEPLOY_USER: mokoconsulting
  COMPOSE_DIR: /opt/gitea

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Determine version tag
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "tag=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
          else
            # Use short SHA for automatic deploys
            echo "tag=sha-$(echo ${{ github.sha }} | cut -c1-8)" >> $GITHUB_OUTPUT
          fi

      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: src/go.mod
          cache-dependency-path: src/go.sum

      - name: Download Go modules
        run: cd src && go mod download

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Install pnpm
        run: npm install -g pnpm

      - name: Install frontend deps
        run: pnpm install --frozen-lockfile

      - name: Build frontend
        run: make frontend

      - name: Build backend
        run: make backend
        env:
          TAGS: bindata sqlite sqlite_unlock_notify

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea Container Registry
        run: |
          echo "${{ secrets.DEPLOY_GITEA_TOKEN }}" | docker login ${{ env.REGISTRY }} \
            -u ${{ secrets.DEPLOY_GITEA_USER }} --password-stdin

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.version.outputs.tag }}
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Deploy to production
        env:
          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          VERSION_TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Set up SSH
          mkdir -p ~/.ssh
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -p ${{ env.DEPLOY_PORT }} ${{ env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          SSH_CMD="ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }}"

          # Pull new image
          $SSH_CMD "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE }}:${VERSION_TAG}"

          # Update docker-compose.yml with new tag
          $SSH_CMD "cd ${{ env.COMPOSE_DIR }} && \
            sed -i 's|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:${VERSION_TAG}|' docker-compose.yml"

          # Restart gitea container only (not act_runner)
          $SSH_CMD "cd ${{ env.COMPOSE_DIR }} && \
            docker compose up -d gitea"

          # Wait for health check
          $SSH_CMD "for i in 1 2 3 4 5 6; do \
            sleep 10; \
            if docker inspect --format='{{.State.Health.Status}}' gitea 2>/dev/null | grep -q healthy; then \
              echo 'Gitea is healthy'; exit 0; \
            fi; \
            echo 'Waiting for health check... (attempt \$i/6)'; \
          done; \
          echo 'WARNING: Health check did not pass within 60s'; exit 1"

      - name: Verify deployment
        env:
          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key

          SSH_CMD="ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }}"

          # Check running version
          $SSH_CMD "docker inspect gitea --format='{{.Config.Image}}'"

          # Check API health
          curl -sf https://${{ env.DEPLOY_HOST }}/api/healthz || echo "API health check pending"

      - name: Notify on failure
        if: failure()
        run: |
          echo "::error::MokoGitea deploy failed for tag ${{ steps.version.outputs.tag }}"
          # Optional: send ntfy notification
          curl -sf -d "MokoGitea deploy FAILED: ${{ steps.version.outputs.tag }}" \
            "https://${{ env.DEPLOY_HOST }}:8443/mokogitea-deploy" 2>/dev/null || true