staging.yml

name: Staging

on:
  workflow_dispatch:
    inputs:
      surface:
        description: "Remote release surface"
        required: true
        type: choice
        default: full
        options:
          - frontend
          - backend
          - full
      runtime_smoke:
        description: "Enable runtime smoke"
        required: true
        type: boolean
        default: true
      skip_smoke:
        description: "Skip post-deploy smoke"
        required: true
        type: boolean
        default: false

concurrency:
  group: staging-manual-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  staging-release-paused:
    if: vars.STAGING_RELEASE_PAUSED == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Write paused staging summary
        shell: bash
        run: |
          {
            echo "## Manual Staging Deploy"
            echo
            echo "- Surface: \`${{ inputs.surface }}\`"
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Status: \`paused\`"
            echo "- Pause reason: \`STAGING_RELEASE_PAUSED=true\`"
            echo "- Actions run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          } >> "$GITHUB_STEP_SUMMARY"

  staging-release:
    if: vars.STAGING_RELEASE_PAUSED != 'true'
    runs-on: ubuntu-latest
    environment: staging

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Run production contract gate
        run: bash scripts/production_contract_gate.sh
        env:
          BACKEND_PYTHON: python

      - name: Run staging release
        id: remote_release
        uses: ./.github/actions/remote-release
        with:
          surface: ${{ inputs.surface }}
          deploy_host: ${{ secrets.DEPLOY_HOST }}
          base_url: ${{ secrets.DEPLOYMATE_BASE_URL }}
          admin_username: ${{ secrets.DEPLOYMATE_ADMIN_USERNAME }}
          admin_password: ${{ secrets.DEPLOYMATE_ADMIN_PASSWORD }}
          deploy_ssh_private_key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
          deploy_ssh_known_hosts: ${{ secrets.DEPLOY_SSH_KNOWN_HOSTS }}
          runtime_smoke_enabled: ${{ inputs.runtime_smoke && '1' || '0' }}
          skip_smoke: ${{ inputs.skip_smoke && '1' || '0' }}
          deploy_repo_dir: ${{ secrets.DEPLOY_REPO_DIR }}
          deploy_branch: ${{ secrets.DEPLOY_BRANCH }}
          deploy_ref: ${{ github.sha }}
          deploy_env_file: ${{ secrets.DEPLOY_ENV_FILE }}
          deploy_compose_file: ${{ secrets.DEPLOY_COMPOSE_FILE }}
          runtime_smoke_ssh_private_key: ${{ secrets.RUNTIME_SMOKE_SSH_PRIVATE_KEY }}
          runtime_smoke_server_id: ${{ secrets.RUNTIME_SMOKE_SERVER_ID }}
          runtime_smoke_server_name: ${{ secrets.RUNTIME_SMOKE_SERVER_NAME }}
          runtime_smoke_server_host: ${{ secrets.RUNTIME_SMOKE_SERVER_HOST }}
          runtime_smoke_server_port: ${{ secrets.RUNTIME_SMOKE_SERVER_PORT }}
          runtime_smoke_server_username: ${{ secrets.RUNTIME_SMOKE_SERVER_USERNAME }}
          runtime_smoke_image: ${{ secrets.RUNTIME_SMOKE_IMAGE }}
          runtime_smoke_internal_port: ${{ secrets.RUNTIME_SMOKE_INTERNAL_PORT }}
          runtime_smoke_external_port: ${{ secrets.RUNTIME_SMOKE_EXTERNAL_PORT }}
          runtime_smoke_start_port: ${{ secrets.RUNTIME_SMOKE_START_PORT }}
          runtime_smoke_health_timeout: ${{ secrets.RUNTIME_SMOKE_HEALTH_TIMEOUT }}

      - name: Write staging summary
        if: always()
        shell: bash
        run: |
          {
            echo "## Manual Staging Deploy"
            echo
            echo "- Surface: \`${{ inputs.surface }}\`"
            echo "- Commit: \`${{ github.sha }}\`"
            echo "- Deployed SHA: \`${{ steps.remote_release.outputs.deployed_sha || 'unavailable' }}\`"
            echo "- Smoke mode: \`${{ steps.remote_release.outputs.smoke_mode || (inputs.skip_smoke && 'post-deploy skipped' || (inputs.runtime_smoke && 'runtime enabled' || 'runtime disabled')) }}\`"
            echo "- URL: ${{ steps.remote_release.outputs.target_url || secrets.DEPLOYMATE_BASE_URL }}"
            echo "- Actions run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Notify staging result
        if: always()
        continue-on-error: true
        shell: bash
        env:
          DEPLOY_NOTIFICATION_WEBHOOK: ${{ secrets.DEPLOY_NOTIFICATION_WEBHOOK }}
        run: |
          if [ -z "$DEPLOY_NOTIFICATION_WEBHOOK" ]; then
            echo "[notify] DEPLOY_NOTIFICATION_WEBHOOK is not configured"
            exit 0
          fi

          bash scripts/send_workflow_notification.sh \
            --webhook-url "$DEPLOY_NOTIFICATION_WEBHOOK" \
            --workflow "Manual staging deploy" \
            --environment "staging" \
            --status "${{ job.status }}" \
            --surface "${{ inputs.surface }}" \
            --smoke "${{ steps.remote_release.outputs.smoke_mode || (inputs.skip_smoke && 'post-deploy skipped' || (inputs.runtime_smoke && 'runtime enabled' || 'runtime disabled')) }}" \
            --commit "${{ github.sha }}" \
            --ref "${{ github.ref_name }}" \
            --run-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"