edr-platform/.github/workflows/deploy.yml

name: Deploy Stacks
on:
  push:
    branches:
      - main
      - dev
      - staging
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  detect-changes:
    name: Detect changed services
    runs-on: self-hosted
    outputs:
      matrix: ${{ steps.filter.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Determine changed services
        id: filter
        run: |
          set -euo pipefail

          ALL_SERVICES=(
            "freight-api"
            "freight-portal"
            "freight-backoffice"
            "passenger-api"
            "passenger-portal"
            "passenger-backoffice"
            "payment-api"
          )

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            JSON=$(printf '%s\n' "${ALL_SERVICES[@]}" | jq -R . | jq -sc .)
            echo "matrix=${JSON}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          CHANGED=$(git diff --name-only HEAD~1 HEAD)
          echo "=== Changed files ==="
          echo "$CHANGED"
          echo "====================="

          SERVICES=()

          NON_DEPLOYABLE_PATTERN="^docs/|^README[.]md$|^DEPLOYMENT[.]md$|^CLAUDE[.]md$|^checkpoint[.]md$|^orgstructure[.]md$|^ITMLS_DB_Design[.]md$|.*[.]md$|^[.]eslintrc|^[.]prettierrc|^[.]editorconfig|^[.]gitignore|^[.]gitattributes|^commitlint[.]config[.]js$"

          GLOBAL_PATTERN="^[.]github/|^docker-compose[.]yaml$|^turbo[.]json$|^tsconfig[.]json$|^tsconfig[.]base[.]json$|^pnpm-workspace[.]yaml$|^pnpm-lock[.]yaml$|^package[.]json$|^[.]env([.][a-z]+)?$|^packages/|^infrastructure/|^scripts/deploy/|^wagon[.][^/]*[.]ts$|^cargo[.][^/]*[.]ts$|^container[.][^/]*[.]ts$|^use-[^/]*[.]ts$|^[^/]*[.]service[.]ts$|^[^/]*[.]entity[.]ts$|^[^/]*-types[.]ts$"
          
          DEPLOYABLE=$(echo "$CHANGED" | grep -vE "$NON_DEPLOYABLE_PATTERN" || true)
          if [ -z "$DEPLOYABLE" ]; then
            echo "Only non-deployable files changed. Skipping deploy."
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if echo "$CHANGED" | grep -qE "$GLOBAL_PATTERN"; then
            echo "Global file(s) changed — deploying all services."
            JSON=$(printf '%s\n' "${ALL_SERVICES[@]}" | jq -R . | jq -sc .)
            echo "matrix=${JSON}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "$CHANGED" | grep -q "^apps/edr-freight-api/"              && SERVICES+=("freight-api")
          echo "$CHANGED" | grep -q "^apps/edr-freight-portal/"           && SERVICES+=("freight-portal")
          echo "$CHANGED" | grep -q "^apps/edr-freight-backoffice/"       && SERVICES+=("freight-backoffice")
          echo "$CHANGED" | grep -q "^apps/edr-passenger-api/"            && SERVICES+=("passenger-api")
          echo "$CHANGED" | grep -q "^apps/edr-passenger-web/portal/"     && SERVICES+=("passenger-portal")
          echo "$CHANGED" | grep -q "^apps/edr-passenger-web/backoffice/" && SERVICES+=("passenger-backoffice")
          echo "$CHANGED" | grep -q "^apps/edr-payment-api/"              && SERVICES+=("payment-api")

          SERVICES=($(printf '%s\n' "${SERVICES[@]}" | sort -u))

          if [ ${#SERVICES[@]} -eq 0 ]; then
            echo "No deployable service changes detected."
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
          else
            echo "Services to deploy: ${SERVICES[*]}"
            JSON=$(printf '%s\n' "${SERVICES[@]}" | jq -R . | jq -sc .)
            echo "matrix=${JSON}" >> "$GITHUB_OUTPUT"
          fi

  deploy:
    name: Deploy ${{ matrix.service }}
    needs: detect-changes
    if: ${{ needs.detect-changes.outputs.matrix != '[]' }}
    runs-on: self-hosted
    strategy:
      fail-fast: false
      matrix:
        service: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
    env:
      BRANCH: ${{ github.ref_name }}
      DEPLOY_USER: tria
      DOCKER_BUILDKIT: "1"
      COMPOSE_DOCKER_CLI_BUILD: "1"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve project and build env file
        run: |
          case "${{ matrix.service }}" in
            freight-api|freight-portal|freight-backoffice)
              echo "PROJECT=edr-freight"                      >> "$GITHUB_ENV"
              echo "BUILD_ENV_FILE=freight-web.build.env"    >> "$GITHUB_ENV"
              ;;
            passenger-api|passenger-portal|passenger-backoffice)
              echo "PROJECT=edr-passenger"                   >> "$GITHUB_ENV"
              echo "BUILD_ENV_FILE=passenger-web.build.env"  >> "$GITHUB_ENV"
              ;;
            payment-api)
              echo "PROJECT=edr-payment"                     >> "$GITHUB_ENV"
              echo "BUILD_ENV_FILE=payment-web.build.env"    >> "$GITHUB_ENV"
              ;;
            *)
              echo "Unknown service: ${{ matrix.service }}" && exit 1
              ;;
          esac

      - name: Sync environment from server
        run: |
          chmod +x scripts/deploy/*.sh
          ./scripts/deploy/sync-env-from-server.sh "${{ matrix.service }}"

      - name: Set compose project name
        run: |
          set -euo pipefail
          branch_slug=$(echo "${BRANCH}" | tr "[:upper:]" "[:lower:]" | sed -E "s/[^a-z0-9]+/-/g; s/^-+//; s/-+$//")
          echo "COMPOSE_PROJECT_NAME=${PROJECT}-${branch_slug}" >> "${GITHUB_ENV}"

      - name: Configure npm auth for Docker builds
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: ./scripts/deploy/create-npmrc.sh

      - name: Build ${{ matrix.service }}
        run: |
          set -euo pipefail
          docker compose --project-name "${COMPOSE_PROJECT_NAME}" build --no-cache "${{ matrix.service }}"

      - name: Deploy ${{ matrix.service }}
        run: |
          set -euo pipefail
          docker compose --project-name "${COMPOSE_PROJECT_NAME}" up -d "${{ matrix.service }}"

      - name: Remove npm credentials from workspace
        if: always()
        run: rm -f .npmrc .npmrc_temp