deploy.yml

name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      ref:
        description: "Ref (branch / tag / SHA) to build and deploy. Defaults to main."
        required: false
        default: "main"

permissions:
  contents: read
  packages: write

concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  build-and-push:
    name: build and push
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      image_digest: ${{ steps.push.outputs.digest }}
      target_sha: ${{ steps.resolve.outputs.sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ inputs.ref || github.sha }}
          fetch-depth: 1

      - name: Resolve SHA
        id: resolve
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: push
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
          tags: |
            ghcr.io/stoganet/api-proxy:${{ steps.resolve.outputs.sha }}
            ghcr.io/stoganet/api-proxy:latest

  trigger-infra-bump:
    name: trigger infra bump
    needs: build-and-push
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Preflight
        env:
          INFRA_DISPATCH_TOKEN: ${{ secrets.INFRA_DISPATCH_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${INFRA_DISPATCH_TOKEN:-}" ]; then
            echo "::error::INFRA_DISPATCH_TOKEN not set — needs contents:write on Stoganet/infra"
            exit 1
          fi

      - name: Dispatch
        env:
          GH_TOKEN: ${{ secrets.INFRA_DISPATCH_TOKEN }}
          OWNER: ${{ github.repository_owner }}
          TARGET_SHA: ${{ needs.build-and-push.outputs.target_sha }}
          IMAGE_DIGEST: ${{ needs.build-and-push.outputs.image_digest }}
        run: |
          set -euo pipefail
          [ -n "${IMAGE_DIGEST}" ] || { echo "::error::IMAGE_DIGEST is empty"; exit 1; }
          [ -n "${TARGET_SHA}" ]   || { echo "::error::TARGET_SHA is empty"; exit 1; }
          gh api -X POST "repos/${OWNER}/infra/dispatches" \
            -f "event_type=api-proxy-bump" \
            -f "client_payload[sha]=${TARGET_SHA}" \
            -f "client_payload[digest]=${IMAGE_DIGEST}"