household-bot/.github/workflows/cd.yml

name: CD

on:
  workflow_run:
    workflows:
      - CI
    types:
      - completed
    branches:
      - main
      - dev
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        default: 'dev'
        type: choice
        options:
          - dev
          - prod
      ref:
        description: 'Git ref to deploy (branch, tag, or SHA)'
        required: true
        default: 'dev'

permissions:
  contents: read
  id-token: write

concurrency:
  group: cd-${{ github.event_name == 'workflow_dispatch' && inputs.environment || github.ref_name }}
  cancel-in-progress: false

jobs:
  detect-environment:
    name: Detect environment
    runs-on: ubuntu-latest
    outputs:
      target_env: ${{ steps.detect.outputs.target_env }}
      github_environment: ${{ steps.detect.outputs.github_environment }}
      db_schema: ${{ steps.detect.outputs.db_schema }}
      service_suffix: ${{ steps.detect.outputs.service_suffix }}
      bot_secret_id: ${{ steps.detect.outputs.bot_secret_id }}
      db_secret_name: ${{ steps.detect.outputs.db_secret_name }}
      ref: ${{ steps.detect.outputs.ref }}

    steps:
      - name: Determine target environment
        id: detect
        run: |
          # Determine environment from input (manual) or branch (auto)
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            target_env="${{ inputs.environment }}"
            ref="${{ inputs.ref }}"
          else
            # Auto-detect from branch
            if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
              target_env="prod"
            else
              target_env="dev"
            fi
            ref="${{ github.event.workflow_run.head_sha }}"
          fi

          # Set derived values
          if [[ "$target_env" == "prod" ]]; then
            github_environment="Production"
            db_schema="public"
            service_suffix="prod"
            bot_secret_id="telegram-bot-token"
            db_secret_name="DATABASE_URL"
          else
            github_environment="Development"
            db_schema="test"
            service_suffix="dev"
            bot_secret_id="telegram-bot-token-test"
            db_secret_name="DATABASE_URL_TEST"
          fi

          echo "target_env=$target_env" >> "$GITHUB_OUTPUT"
          echo "github_environment=$github_environment" >> "$GITHUB_OUTPUT"
          echo "db_schema=$db_schema" >> "$GITHUB_OUTPUT"
          echo "service_suffix=$service_suffix" >> "$GITHUB_OUTPUT"
          echo "bot_secret_id=$bot_secret_id" >> "$GITHUB_OUTPUT"
          echo "db_secret_name=$db_secret_name" >> "$GITHUB_OUTPUT"
          echo "ref=$ref" >> "$GITHUB_OUTPUT"

          echo "Target environment: $target_env"
          echo "GitHub Environment: $github_environment"
          echo "DB Schema: $db_schema"
          echo "Service Suffix: $service_suffix"
          echo "Deploy ref: $ref"

  check-secrets:
    name: Check deploy prerequisites
    runs-on: ubuntu-latest
    needs: detect-environment
    environment: ${{ needs.detect-environment.outputs.github_environment }}
    outputs:
      eligible_event: ${{ steps.check.outputs.eligible_event }}
      secrets_ok: ${{ steps.check.outputs.secrets_ok }}
      db_secret_ok: ${{ steps.check.outputs.db_secret_ok }}

    steps:
      - name: Evaluate trigger and required secrets
        id: check
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          GCP_SERVICE_ACCOUNT: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          DATABASE_URL: ${{ secrets[needs.detect-environment.outputs.db_secret_name] }}
        run: |
          eligible_event=false
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            eligible_event=true
          elif [[ "${{ github.event_name }}" == "workflow_run" && "${{ github.event.workflow_run.conclusion }}" == "success" ]]; then
            eligible_event=true
          fi

          secrets_ok=false
          if [[ -n "$GCP_PROJECT_ID" && -n "$GCP_WORKLOAD_IDENTITY_PROVIDER" && -n "$GCP_SERVICE_ACCOUNT" ]]; then
            secrets_ok=true
          fi

          db_secret_ok=false
          if [[ -n "$DATABASE_URL" ]]; then
            db_secret_ok=true
          fi

          echo "eligible_event=$eligible_event" >> "$GITHUB_OUTPUT"
          echo "secrets_ok=$secrets_ok" >> "$GITHUB_OUTPUT"
          echo "db_secret_ok=$db_secret_ok" >> "$GITHUB_OUTPUT"

  deploy:
    name: Deploy Cloud Run
    runs-on: ubuntu-latest
    needs: [detect-environment, check-secrets]
    timeout-minutes: 30
    if: ${{ needs.check-secrets.outputs.eligible_event == 'true' && needs.check-secrets.outputs.secrets_ok == 'true' && needs.check-secrets.outputs.db_secret_ok == 'true' }}
    environment: ${{ needs.detect-environment.outputs.github_environment }}
    env:
      GCP_REGION: ${{ vars.GCP_REGION || 'europe-west1' }}
      ARTIFACT_REPOSITORY: ${{ vars.ARTIFACT_REPOSITORY || 'household-bot' }}
      SERVICE_SUFFIX: ${{ needs.detect-environment.outputs.service_suffix }}
      DB_SCHEMA: ${{ needs.detect-environment.outputs.db_schema }}
      BOT_SECRET_ID: ${{ needs.detect-environment.outputs.bot_secret_id }}

    steps:
      - name: Checkout deployment ref
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.detect-environment.outputs.ref }}

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: .bun-version

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Run database migrations
        env:
          DATABASE_URL: ${{ secrets[needs.detect-environment.outputs.db_secret_name] }}
          DB_SCHEMA: ${{ needs.detect-environment.outputs.db_schema }}
        run: bun run db:migrate

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@v2

      - name: Load Telegram bot token for command sync
        id: telegram-token
        run: |
          set +e
          token="$(gcloud secrets versions access latest \
            --secret "${BOT_SECRET_ID}" \
            --project "${{ secrets.GCP_PROJECT_ID }}" 2>/dev/null)"
          status=$?
          set -e

          if [[ $status -ne 0 || -z "$token" ]]; then
            echo "available=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "::add-mask::$token"
          {
            echo "available=true"
            echo "token<<EOF"
            echo "$token"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Configure Artifact Registry auth
        run: |
          gcloud auth configure-docker "${GCP_REGION}-docker.pkg.dev" --quiet

      - name: Resolve image tags
        id: images
        run: |
          bot_image="${GCP_REGION}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${ARTIFACT_REPOSITORY}/bot:${GITHUB_SHA}"
          mini_image="${GCP_REGION}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${ARTIFACT_REPOSITORY}/miniapp:${GITHUB_SHA}"

          echo "bot_image=$bot_image" >> "$GITHUB_OUTPUT"
          echo "mini_image=$mini_image" >> "$GITHUB_OUTPUT"

      - name: Build and push bot image
        run: |
          docker build -f apps/bot/Dockerfile -t "${{ steps.images.outputs.bot_image }}" .
          docker push "${{ steps.images.outputs.bot_image }}"

      - name: Build and push mini app image
        run: |
          docker build -f apps/miniapp/Dockerfile -t "${{ steps.images.outputs.mini_image }}" .
          docker push "${{ steps.images.outputs.mini_image }}"

      - name: Deploy bot service
        run: |
          gcloud run deploy "household-${SERVICE_SUFFIX}-bot-api" \
            --image "${{ steps.images.outputs.bot_image }}" \
            --region "${GCP_REGION}" \
            --project "${{ secrets.GCP_PROJECT_ID }}" \
            --set-env-vars "DB_SCHEMA=${DB_SCHEMA}" \
            --allow-unauthenticated \
            --quiet

      - name: Deploy mini app service
        run: |
          gcloud run deploy "household-${SERVICE_SUFFIX}-mini-app" \
            --image "${{ steps.images.outputs.mini_image }}" \
            --region "${GCP_REGION}" \
            --project "${{ secrets.GCP_PROJECT_ID }}" \
            --allow-unauthenticated \
            --quiet

      - name: Sync Telegram commands
        if: ${{ steps.telegram-token.outputs.available == 'true' }}
        env:
          TELEGRAM_BOT_TOKEN: ${{ steps.telegram-token.outputs.token }}
        run: bun run ops:telegram:commands set

      - name: Set Telegram Webhook
        if: ${{ steps.telegram-token.outputs.available == 'true' }}
        env:
          TELEGRAM_BOT_TOKEN: ${{ steps.telegram-token.outputs.token }}
        run: |
          SERVICE_URL=$(gcloud run services describe "household-${SERVICE_SUFFIX}-bot-api" \
            --region "${GCP_REGION}" \
            --project "${{ secrets.GCP_PROJECT_ID }}" \
            --format 'value(status.url)')

          export TELEGRAM_WEBHOOK_URL="$SERVICE_URL/webhook/telegram"
          bun run ops:telegram:webhook set