edr-platform/.github/workflows/deploy.yml

name: Deploy Stacks
on:
  push:
    branches:
      - main
      - dev
      - staging
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  detect-changes:
    name: Detect changed services
    runs-on: self-hosted
    outputs:
      matrix: ${{ steps.filter.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Determine changed services
        id: filter
        run: |
          set -euo pipefail
          ALL_SERVICES=(
            "freight-api"
            # "freight-portal"
            # "freight-backoffice"
            "passenger-api"
            "passenger-portal"
            "passenger-backoffice"
            "payment-api"
          )

          # workflow_dispatch: deploy everything
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            JSON=$(printf '%s\n' "${ALL_SERVICES[@]}" | jq -R . | jq -sc .)
            echo "matrix=${JSON}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          CHANGED=$(git diff --name-only HEAD~1 HEAD)
          echo "=== Changed files ==="
          echo "$CHANGED"
          echo "====================="

          SERVICES=()

          # -------------------------------------------------------
          # Tier 1: Non-deployable files — skip if ONLY these changed
          # -------------------------------------------------------
          NON_DEPLOYABLE_PATTERN="^docs/\
|^README\.md$\
|^DEPLOYMENT\.md$\
|^CLAUDE\.md$\
|^checkpoint\.md$\
|^orgstructure\.md$\
|^ITMLS_DB_Design\.md$\
|.*\.md$\
|^\.eslintrc\
|^\.prettierrc\
|^\.editorconfig\
|^\.gitignore\
|^\.gitattributes\
|^commitlint\.config\.js$"

          ALL_NON_DEPLOYABLE=true
          while IFS= read -r file; do
            if ! echo "$file" | grep -qE "$NON_DEPLOYABLE_PATTERN"; then
              ALL_NON_DEPLOYABLE=false
              break
            fi
          done <<< "$CHANGED"

          if [ "$ALL_NON_DEPLOYABLE" = "true" ]; then
            echo "Only non-deployable files changed. Skipping deploy."
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # -------------------------------------------------------
          # Tier 2: Global files — deploy all services
          # -------------------------------------------------------
          GLOBAL_PATTERN="^\.github/\
|^docker-compose\.yaml$\
|^turbo\.json$\
|^tsconfig\.json$\
|^tsconfig\.base\.json$\
|^pnpm-workspace\.yaml$\
|^pnpm-lock\.yaml$\
|^package\.json$\
|^\.env(\.[a-z]+)?$\
|^packages/\
|^infrastructure/\
|^scripts/deploy/\
|^wagon.*\.ts$\
|^cargo.*\.ts$\
|^container.*\.ts$\
|^use-.*\.ts$\
|^.*\.service\.ts$\
|^.*\.entity\.ts$\
|^.*-types\.ts$"

          if echo "$CHANGED" | grep -qE "$GLOBAL_PATTERN"; then
            echo "Global file(s) changed — deploying all services."
            JSON=$(printf '%s\n' "${ALL_SERVICES[@]}" | jq -R . | jq -sc .)
            echo "matrix=${JSON}" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # -------------------------------------------------------
          # Tier 3: Per-service app paths (exact structure)
          # -------------------------------------------------------

          # Freight
          echo "$CHANGED" | grep -q "^apps/edr-freight-api/"            && SERVICES+=("freight-api")
          # echo "$CHANGED" | grep -q "^apps/edr-freight-web/portal/"     && SERVICES+=("freight-portal")
          # echo "$CHANGED" | grep -q "^apps/edr-freight-web/backoffice/" && SERVICES+=("freight-backoffice")

          # Passenger
          echo "$CHANGED" | grep -q "^apps/edr-passenger-api/"            && SERVICES+=("passenger-api")
          echo "$CHANGED" | grep -q "^apps/edr-passenger-web/portal/"     && SERVICES+=("passenger-portal")
          echo "$CHANGED" | grep -q "^apps/edr-passenger-web/backoffice/" && SERVICES+=("passenger-backoffice")

          # Payment
          echo "$CHANGED" | grep -q "^apps/edr-payment-api/"             && SERVICES+=("payment-api")

          # Deduplicate while preserving consistent order
          SERVICES=($(printf '%s\n' "${SERVICES[@]}" | sort -u))

          if [ ${#SERVICES[@]} -eq 0 ]; then
            echo "No deployable service changes detected."
            echo "matrix=[]" >> "$GITHUB_OUTPUT"
          else
            echo "Services to deploy: ${SERVICES[*]}"
            JSON=$(printf '%s\n' "${SERVICES[@]}" | jq -R . | jq -sc .)
            echo "matrix=${JSON}" >> "$GITHUB_OUTPUT"
          fi

  deploy:
    name: Deploy ${{ matrix.service }}
    needs: detect-changes
    if: ${{ needs.detect-changes.outputs.matrix != '[]' }}
    runs-on: self-hosted
    strategy:
      fail-fast: false
      matrix:
        service: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
    env:
      BRANCH: ${{ github.ref_name }}
      DEPLOY_USER: tria
      DOCKER_BUILDKIT: "1"
      COMPOSE_DOCKER_CLI_BUILD: "1"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve project and build env file
        run: |
          case "${{ matrix.service }}" in
            freight-api|freight-portal|freight-backoffice)
              echo "PROJECT=edr-freight"                      >> "$GITHUB_ENV"
              echo "BUILD_ENV_FILE=freight-web.build.env"    >> "$GITHUB_ENV"
              ;;
            passenger-api|passenger-portal|passenger-backoffice)
              echo "PROJECT=edr-passenger"                   >> "$GITHUB_ENV"
              echo "BUILD_ENV_FILE=passenger-web.build.env"  >> "$GITHUB_ENV"
              ;;
            payment-api)
              echo "PROJECT=edr-payment"                     >> "$GITHUB_ENV"
              echo "BUILD_ENV_FILE=payment-web.build.env"    >> "$GITHUB_ENV"
              ;;
            *)
              echo "Unknown service: ${{ matrix.service }}" && exit 1
              ;;
          esac

      - name: Sync environment from server
        run: |
          chmod +x scripts/deploy/*.sh
          ./scripts/deploy/sync-env-from-server.sh "${{ matrix.service }}"

      - name: Set compose project name
        run: |
          set -euo pipefail
          branch_slug=$(echo "${BRANCH}" | tr "[:upper:]" "[:lower:]" | sed -E "s/[^a-z0-9]+/-/g; s/^-+//; s/-+$//")
          echo "COMPOSE_PROJECT_NAME=${PROJECT}-${branch_slug}" >> "${GITHUB_ENV}"

      - name: Configure npm auth for Docker builds
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: ./scripts/deploy/create-npmrc.sh

      - name: Build ${{ matrix.service }}
        run: |
          set -euo pipefail
          docker compose --project-name "${COMPOSE_PROJECT_NAME}" build --no-cache "${{ matrix.service }}"

      - name: Deploy ${{ matrix.service }}
        run: |
          set -euo pipefail
          docker compose --project-name "${COMPOSE_PROJECT_NAME}" up -d "${{ matrix.service }}"

      - name: Remove npm credentials from workspace
        if: always()
        run: rm -f .npmrc .npmrc_temp