name: Deploy Passenger

on:
  push:
    branches:
      - main
      - develop
      - staging
    paths:
      - "apps/edr-passenger-api/**"
      - "apps/edr-passenger-web/**"
      - "packages/**"
      - "infrastructure/docker/Dockerfile.web"
      - "infrastructure/nginx/**"
      - "docker-compose.yaml"
      - "pnpm-lock.yaml"
      - "scripts/deploy/**"
      - ".github/workflows/deploy-passenger.yml"
  workflow_dispatch:

concurrency:
  group: deploy-passenger-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  deploy:
    name: Build and deploy passenger stack
    runs-on: self-hosted
    env:
      PROJECT: edr-passenger
      BRANCH: ${{ github.ref_name }}
      DEPLOY_USER: user
      BUILD_ENV_FILE: passenger-web.build.env
      DOCKER_BUILDKIT: "1"
      COMPOSE_DOCKER_CLI_BUILD: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Sync environment from server
        run: |
          chmod +x scripts/deploy/*.sh
          ./scripts/deploy/sync-env-from-server.sh \
            passenger-api \
            passenger-portal \
            passenger-backoffice

      - name: Configure npm auth for Docker builds
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: ./scripts/deploy/create-npmrc.sh

      - name: Build images
        run: |
          set -euo pipefail
          docker compose build \
            passenger-api \
            passenger-portal \
            passenger-backoffice

      - name: Deploy containers
        run: |
          set -euo pipefail
          docker compose up -d \
            passenger-api \
            passenger-portal \
            passenger-backoffice

      - name: Remove npm credentials from workspace
        if: always()
        run: rm -f .npmrc .npmrc_temp