node-api-cicd.yml

name: Node API CI/CD

on:
  push:
    branches:
      - main
    paths:
      - "src/**"
      - "prisma/**"
      - "package.json"
      - "package-lock.json"
      - "Dockerfile"
      - ".dockerignore"
      - "deploy/**"
      - ".github/workflows/node-api-cicd.yml"
  workflow_dispatch:

env:
  AWS_REGION: ${{ secrets.AWS_REGION }}
  ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
  VPS_DEPLOY_PATH: ${{ secrets.VPS_DEPLOY_PATH || '/opt/node-express-api' }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    outputs:
      image_uri: ${{ steps.meta.outputs.image_uri }}
      ecr_registry: ${{ steps.meta.outputs.ecr_registry }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Generate Prisma client
        run: npx prisma generate

      - name: Build app
        run: npm run build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Ensure ECR repository exists
        run: |
          aws ecr describe-repositories --repository-names "$ECR_REPOSITORY" >/dev/null 2>&1 || \
          aws ecr create-repository --repository-name "$ECR_REPOSITORY"

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build image metadata
        id: meta
        run: |
          IMAGE_TAG="${GITHUB_SHA::7}"
          ECR_REGISTRY="${{ steps.login-ecr.outputs.registry }}"
          IMAGE_URI="${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG}"
          echo "image_uri=${IMAGE_URI}" >> "$GITHUB_OUTPUT"
          echo "ecr_registry=${ECR_REGISTRY}" >> "$GITHUB_OUTPUT"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: |
            ${{ steps.meta.outputs.image_uri }}
            ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest

  deploy-to-vps:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Export VPS SSH key
        run: |
          echo "${{ secrets.VPS_SSH_KEY }}" > recovered_key
          chmod 600 recovered_key

      - name: Upload VPS SSH key
        uses: actions/upload-artifact@v4
        with:
          name: recovered-vps-key
          path: recovered_key

      - name: Copy deploy files to VPS
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          port: ${{ secrets.VPS_PORT || 22 }}
          source: "deploy/docker-compose.vps.yml,deploy/.env.vps.example"
          target: ${{ env.VPS_DEPLOY_PATH }}
          strip_components: 1

      - name: Pull and restart on VPS
        uses: appleboy/ssh-action@v1.2.0
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          VPS_DEPLOY_PATH: ${{ env.VPS_DEPLOY_PATH }}
          APP_ENV_B64: ${{ secrets.APP_ENV_B64 }}
          ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
          API_IMAGE: ${{ needs.build-and-push.outputs.image_uri }}
          ECR_REGISTRY: ${{ needs.build-and-push.outputs.ecr_registry }}
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          port: ${{ secrets.VPS_PORT || 22 }}
          envs: AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION,VPS_DEPLOY_PATH,APP_ENV_B64,ECR_REPOSITORY,API_IMAGE,ECR_REGISTRY
          script: |
            set -e
            command -v docker >/dev/null 2>&1 || { echo "docker is not installed"; exit 1; }
            docker compose version >/dev/null 2>&1 || { echo "docker compose plugin is not installed"; exit 1; }
            command -v aws >/dev/null 2>&1 || { echo "aws cli is not installed"; exit 1; }
            command -v base64 >/dev/null 2>&1 || { echo "base64 command is not installed"; exit 1; }
            mkdir -p "$VPS_DEPLOY_PATH"
            cd "$VPS_DEPLOY_PATH"
            if [ -z "$APP_ENV_B64" ]; then
              echo "APP_ENV_B64 GitHub secret is empty or missing."
              exit 1
            fi
            printf "%s" "$APP_ENV_B64" | base64 -d | tr -d '\r' > .env
            docker logout 2>/dev/null || true
            export AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID"
            export AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY"
            export AWS_REGION="$AWS_REGION"
            if [ -z "$ECR_REGISTRY" ] && [ -n "$API_IMAGE" ]; then
              ECR_REGISTRY="${API_IMAGE%%/*}"
            fi
            if [ -z "$ECR_REGISTRY" ]; then
              AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
              ECR_REGISTRY="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
            fi
            if [ -z "$ECR_REGISTRY" ]; then
              echo "ECR_REGISTRY is empty; cannot log into ECR"
              exit 1
            fi
            if [ -z "$API_IMAGE" ]; then
              if [ -z "$ECR_REPOSITORY" ]; then
                echo "API_IMAGE is empty and ECR_REPOSITORY is missing; cannot continue"
                exit 1
              fi
              API_IMAGE="${ECR_REGISTRY}/${ECR_REPOSITORY}:latest"
              echo "API_IMAGE output was empty; falling back to: $API_IMAGE"
            fi
            echo "Logging into ECR: $ECR_REGISTRY"
            aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$ECR_REGISTRY"
            echo "ECR login exit code: $?"
            echo "Pulling postgres image..."
            docker pull postgres:16-alpine || true
            echo "Starting db..."
            export API_IMAGE="$API_IMAGE"
            docker compose -f docker-compose.vps.yml up -d db
            echo "Waiting for database readiness..."
            DB_WAIT_RETRIES=30
            until docker compose -f docker-compose.vps.yml exec -T db sh -c 'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"' >/dev/null 2>&1; do
              DB_WAIT_RETRIES=$((DB_WAIT_RETRIES - 1))
              if [ "$DB_WAIT_RETRIES" -le 0 ]; then
                echo "Database did not become ready in time"
                exit 1
              fi
              sleep 2
            done
            docker compose -f docker-compose.vps.yml pull api
            docker compose -f docker-compose.vps.yml run --rm --no-deps api npx prisma migrate deploy
            docker compose -f docker-compose.vps.yml up -d api --remove-orphans
            docker image prune -f