cd.yml

name: CD

on:
  push:
    branches: [main, develop]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: deploy-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip

      - name: Install dependencies
        run: pip install -e ".[dev]"

      - name: Run tests
        run: python -m pytest tests/ --cov=paperscout --cov-fail-under=90 -v

  deploy:
    name: Deploy
    needs: test
    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: >-
      ${{ github.ref == 'refs/heads/main' && 'production'
       || github.ref == 'refs/heads/develop' && 'staging'
       || '' }}
    steps:
      - name: Validate GitHub Environment variables
        run: |
          set -euo pipefail
          err() { echo "::error title=Missing environment variable::$1" >&2; exit 1; }
          [ -n "${{ vars.DEPLOY_PATH }}" ] || err "Set Variable DEPLOY_PATH on this job's GitHub Environment (e.g. /opt/paperscout). Settings → Environments → ${{ github.environment }} → Environment variables."
          [ -n "${{ vars.DEPLOY_BRANCH }}" ] || err "Set Variable DEPLOY_BRANCH (e.g. main or develop)."
          [ -n "${{ vars.HEALTH_PORT }}" ] || err "Set Variable HEALTH_PORT to the host port published for GET /health (see docker-compose / README; e.g. 9101). Without it the workflow builds http://localhost:/health and curl fails."

      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SERVER_SSH_KEY }}
          port: ${{ secrets.SERVER_PORT || 22 }}
          command_timeout: 15m
          script: |
            set -euo pipefail
            cd "${{ vars.DEPLOY_PATH }}"
            git fetch origin "${{ vars.DEPLOY_BRANCH }}"
            git checkout "${{ vars.DEPLOY_BRANCH }}"
            git pull --ff-only origin "${{ vars.DEPLOY_BRANCH }}"
            docker compose up -d --build paperscout

      - name: Health check
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SERVER_SSH_KEY }}
          port: ${{ secrets.SERVER_PORT || 22 }}
          command_timeout: 5m
          script: |
            set -euo pipefail
            url="http://localhost:${{ vars.HEALTH_PORT }}/health"
            for i in $(seq 1 12); do
              if curl -sf "$url"; then
                echo "Health check OK after attempt $i"
                exit 0
              fi
              sleep 5
            done
            echo "Health check failed after 12 attempts"
            exit 1