beetask/.github/workflows/deploy-main.yml

name: Deploy to Hostinger

on:
  push:
    branches:
      - main
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  FRONTEND_IMAGE_NAME: ${{ github.repository }}-frontend
  BACKEND_IMAGE_NAME: ${{ github.repository }}-backend

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
          cache: maven

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      # - name: Run backend tests
      #   working-directory: backend
      #   run: ./mvnw -B test

      - name: Run frontend build
        working-directory: frontend
        run: |
          npm ci
          npm run build          

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata for frontend
        id: meta-frontend
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}
          tags: |
            type=raw,value=latest
            type=sha            

      - name: Extract Docker metadata for backend
        id: meta-backend
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}
          tags: |
            type=raw,value=latest
            type=sha            

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push frontend image
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          file: ./frontend/Dockerfile
          push: true
          tags: ${{ steps.meta-frontend.outputs.tags }}
          labels: ${{ steps.meta-frontend.outputs.labels }}
          build-args: |
            VITE_API_URL=${{ secrets.FRONTEND_VITE_API_URL }}            

      - name: Build and push backend image
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          file: ./backend/Dockerfile
          push: true
          tags: ${{ steps.meta-backend.outputs.tags }}
          labels: ${{ steps.meta-backend.outputs.labels }}

      - name: Copy deploy files to server
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.HOSTINGER_HOST }}
          username: ${{ secrets.HOSTINGER_USER }}
          key: ${{ secrets.HOSTINGER_SSH_KEY }}
          port: ${{ secrets.HOSTINGER_PORT || 22 }}
          source: "deploy/docker-compose.prod.yml"
          target: "${{ secrets.HOSTINGER_APP_PATH }}"
          strip_components: 1

      - name: Deploy on Hostinger
        uses: appleboy/ssh-action@v1.2.0
        env:
          FRONTEND_IMAGE: ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE_NAME }}:latest
          BACKEND_IMAGE: ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE_NAME }}:latest
          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
          DB_URL: ${{ secrets.DB_URL }}
          MP_JWT_VERIFY_ISSUER: ${{ secrets.MP_JWT_VERIFY_ISSUER }}
          SMALLRYE_JWT_SIGN_KEY: ${{ secrets.SMALLRYE_JWT_SIGN_KEY }}
          MP_JWT_VERIFY_PUBLICKEY: ${{ secrets.MP_JWT_VERIFY_PUBLICKEY }}
          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
          GHCR_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
          MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
          MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
          MINIO_ENDPOINT: ${{ secrets.MINIO_ENDPOINT }}
          MINIO_PUBLIC_URL: ${{ secrets.MINIO_PUBLIC_URL }}
          MINIO_BUCKET: ${{ secrets.MINIO_BUCKET }}
        with:
          host: ${{ secrets.HOSTINGER_HOST }}
          username: ${{ secrets.HOSTINGER_USER }}
          key: ${{ secrets.HOSTINGER_SSH_KEY }}
          port: ${{ secrets.HOSTINGER_PORT || 22 }}
          envs: FRONTEND_IMAGE,BACKEND_IMAGE,POSTGRES_USER,POSTGRES_PASSWORD,DB_URL,MP_JWT_VERIFY_ISSUER,SMALLRYE_JWT_SIGN_KEY,MP_JWT_VERIFY_PUBLICKEY,GHCR_USERNAME,GHCR_TOKEN,MINIO_ROOT_USER,MINIO_ROOT_PASSWORD,MINIO_ENDPOINT,MINIO_PUBLIC_URL,MINIO_BUCKET
          script: |
            set -eu
            APP_DIR="${{ secrets.HOSTINGER_APP_PATH }}"
            mkdir -p "$APP_DIR"
            cd "$APP_DIR"

            {
              echo "POSTGRES_USER=${POSTGRES_USER}"
              echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
              echo "DB_URL=${DB_URL}"
              echo "FRONTEND_IMAGE=${FRONTEND_IMAGE}"
              echo "BACKEND_IMAGE=${BACKEND_IMAGE}"
              echo "MP_JWT_VERIFY_ISSUER=${MP_JWT_VERIFY_ISSUER}"
              echo "MINIO_ROOT_USER=${MINIO_ROOT_USER}"
              echo "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}"
              echo "MINIO_ENDPOINT=${MINIO_ENDPOINT}"
              echo "MINIO_PUBLIC_URL=${MINIO_PUBLIC_URL}"
              echo "MINIO_BUCKET=${MINIO_BUCKET}"

              printf 'SMALLRYE_JWT_SIGN_KEY="%s"\n' "$SMALLRYE_JWT_SIGN_KEY"
              printf 'MP_JWT_VERIFY_PUBLICKEY="%s"\n' "$MP_JWT_VERIFY_PUBLICKEY"
            } > .env.production

            echo "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USERNAME}" --password-stdin
            docker compose --env-file .env.production -f docker-compose.prod.yml pull
            docker compose --env-file .env.production -f docker-compose.prod.yml up -d
            docker image prune -f