deploy.yml

# CI/CD Deployment Workflow for Digitization Academy
#
# WORKFLOW:
# - Push to 'development' branch → Deploys to DEVELOPMENT automatically
# - Push to 'main' branch → Creates GitHub release with semantic version → Deploys to PRODUCTION
#
# VERSION CONTROL:
# Use commit message tags to control version bumps:
# - [major] or [breaking] → Major version bump (1.0.0 → 2.0.0)
# - [minor] or [feature] → Minor version bump (1.0.0 → 1.1.0)
# - Default (no tag) → Patch version bump (1.0.0 → 1.0.1)
#
# SKIP DEPLOYMENT:
# Add [skip deploy] or [no deploy] to your commit message to push without deploying
#

name: Build and Deploy
on:
  push:
    branches:
      - main        # Creates release and deploys to production
      - development # Development environment
  release:
    types: [published] # Production deployment trigger

permissions:
  id-token: write
  contents: read

jobs:
  # Create release when pushing to main
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: "github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip deploy]') && !contains(github.event.head_commit.message, '[no deploy]')"
    outputs:
      release-tag: ${{ steps.create_release.outputs.tag_name }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Determine version bump
        id: version_bump
        env:
          CURRENT_COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          # Get the latest tag, check if any tags exist
          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")

          if [ -z "$LATEST_TAG" ]; then
            echo "No tags found - this is the first release"
            LATEST_TAG="0.0.0"
            # For first release, show all commits
            COMMITS=$(git log --oneline)
            echo "All commits (first release):"
          else
            echo "Latest tag: $LATEST_TAG"
            # Show commits since last tag
            COMMITS=$(git log ${LATEST_TAG}..HEAD --oneline)
            echo "Commits since last tag:"
          fi

          echo "$COMMITS"
          
          # Get the specific commit message for this push (passed via env to avoid backtick execution)
          echo "Current commit message: $(printf '%s' "$CURRENT_COMMIT_MSG")"
          
          # Determine version bump based on the current commit message only
          if echo "$CURRENT_COMMIT_MSG" | grep -i "\[major\]\|\[breaking\]"; then
            BUMP_TYPE="major"
          elif echo "$CURRENT_COMMIT_MSG" | grep -i "\[minor\]\|\[feature\]"; then
            BUMP_TYPE="minor"  
          else
            BUMP_TYPE="patch"
          fi
          
          echo "Bump type: $BUMP_TYPE"
          echo "bump_type=$BUMP_TYPE" >> $GITHUB_OUTPUT
          echo "current_version=$LATEST_TAG" >> $GITHUB_OUTPUT

      - name: Calculate new version
        id: new_version
        run: |
          CURRENT="${{ steps.version_bump.outputs.current_version }}"
          BUMP_TYPE="${{ steps.version_bump.outputs.bump_type }}"
          
          # Check if this is the first release (no existing tags)
          if [ "$CURRENT" = "0.0.0" ]; then
            echo "First release detected - setting version to 1.0.0"
            NEW_VERSION="1.0.0"
          else
            # Parse current version for subsequent releases
            if [[ $CURRENT =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
              MAJOR=${BASH_REMATCH[1]}
              MINOR=${BASH_REMATCH[2]}
              PATCH=${BASH_REMATCH[3]}
            else
              MAJOR=0
              MINOR=0
              PATCH=0
            fi

            # Increment based on bump type
            case $BUMP_TYPE in
              "major")
                MAJOR=$((MAJOR + 1))
                MINOR=0
                PATCH=0
                ;;
              "minor")
                MINOR=$((MINOR + 1))
                PATCH=0
                ;;
              "patch")
                PATCH=$((PATCH + 1))
                ;;
            esac

            NEW_VERSION="$MAJOR.$MINOR.$PATCH"
          fi

          echo "New version: $NEW_VERSION"
          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT

      - name: Create Release
        id: create_release
        run: |
          # Create release notes based on whether this is first release or not
          if [ "${{ steps.version_bump.outputs.current_version }}" = "0.0.0" ]; then
            RELEASE_NOTES="## What's Changed

          🎉 **First Release!**

          Auto-generated initial release from main branch.

          **Latest commit:**
          \`\`\`
          $COMMIT_MESSAGE
          \`\`\`"
          else
            RELEASE_NOTES="## What's Changed

          Auto-generated release from main branch.

          **Commits included:**
          \`\`\`
          $COMMIT_MESSAGE
          \`\`\`

          **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.version_bump.outputs.current_version }}...${{ steps.new_version.outputs.new_version }}"
          fi

          gh release create "${{ steps.new_version.outputs.new_version }}" \
            --title "Release ${{ steps.new_version.outputs.new_version }}" \
            --notes "$RELEASE_NOTES"
          echo "tag_name=${{ steps.new_version.outputs.new_version }}" >> $GITHUB_OUTPUT
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}

  # ... existing code ...

  build-and-deploy-production:
    needs: create-release
    runs-on: ubuntu-latest
    environment: production
    if: "github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip deploy]') && !contains(github.event.head_commit.message, '[no deploy]')"
    steps:
      - uses: actions/checkout@v5
      - name: Get Runner IP
        id: ip
        uses: haythem/public-ip@v1.3
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::147899039648:role/GitHubActionsDeployRole
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Whitelist Runner IP in AWS Security Group
        run: |
          aws ec2 authorize-security-group-ingress \
            --region ${{ secrets.AWS_REGION }} \
            --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: mbstring, xml, bcmath, ctype, json, tokenizer, pdo, pdo_mysql
      - name: Cache Composer packages
        id: composer-cache
        uses: actions/cache@v3
        with:
          path: vendor
          key: ${{ runner.os }}-php-v3-${{ hashFiles('**/composer.lock') }}
          restore-keys: |
            ${{ runner.os }}-php-v3-
      - name: Create storage directories
        run: |
          mkdir -p storage/framework/cache/data
          mkdir -p storage/framework/sessions
          mkdir -p storage/framework/views
          mkdir -p bootstrap/cache
      - name: Install Composer dependencies (without scripts)
        run: composer install --prefer-dist --no-progress --no-dev --optimize-autoloader --no-scripts
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'
      - name: Install Yarn dependencies
        run: yarn install --frozen-lockfile --ignore-engines
      - name: Build assets for Production
        run: npm run production
      - name: Create deployment package
        run: |
          # Clean any prior
          rm -rf deployment-package || true
          # Create isolated temp dir
          TEMP_DIR=$(mktemp -d)
          # Sync repo files to temp
          rsync -av \
            --exclude=node_modules \
            --exclude=.git \
            --exclude=.github \
            --exclude=tests \
            --exclude=storage/logs \
            --exclude=vendor \
            . "$TEMP_DIR/"
          # Copy assets into temp/public/
          cp -r public/css public/js public/fonts public/images public/svg public/mix-manifest.json "$TEMP_DIR/public/" || true
          # Move to package name
          mv "$TEMP_DIR" deployment-package
      - name: Upload deployment artifact
        uses: actions/upload-artifact@v4
        with:
          name: digitizationacademy-${{ github.sha }}
          path: deployment-package/
          retention-days: 30
      - name: Deploy with Deployer
        uses: deployphp/action@v1
        with:
          private-key: ${{ secrets.DEPLOY_PRIVATE_KEY }}
          dep: deploy production
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_SHA: ${{ github.sha }}
          GITHUB_REPO: ${{ github.repository }}
          OPCACHE_WEBHOOK_TOKEN: ${{ secrets.OPCACHE_WEBHOOK_TOKEN }}
      - name: Revoke Runner IP from AWS Security Group
        if: always()
        run: |
          aws ec2 revoke-security-group-ingress \
            --region ${{ secrets.AWS_REGION }} \
            --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32

  build-and-deploy-development:
    runs-on: ubuntu-latest
    environment: development
    if: "github.ref == 'refs/heads/development' && !contains(github.event.head_commit.message, '[skip deploy]') && !contains(github.event.head_commit.message, '[no deploy]')"
    steps:
      - uses: actions/checkout@v5
      - name: Get Runner IP
        id: ip
        uses: haythem/public-ip@v1.3
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::147899039648:role/GitHubActionsDeployRole
          aws-region: ${{ secrets.AWS_REGION }}
      - name: Whitelist Runner IP in AWS Security Group
        run: |
          aws ec2 authorize-security-group-ingress \
            --region ${{ secrets.AWS_REGION }} \
            --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: mbstring, xml, bcmath, ctype, json, tokenizer, pdo, pdo_mysql
      - name: Cache Composer packages
        id: composer-cache
        uses: actions/cache@v3
        with:
          path: vendor
          key: ${{ runner.os }}-php-v3-${{ hashFiles('**/composer.lock') }}
          restore-keys: |
            ${{ runner.os }}-php-v3-
      - name: Create storage directories
        run: |
          mkdir -p storage/framework/cache/data
          mkdir -p storage/framework/sessions
          mkdir -p storage/framework/views
          mkdir -p bootstrap/cache
      - name: Install Composer dependencies (without scripts)
        run: composer install --prefer-dist --no-progress --no-dev --optimize-autoloader --no-scripts
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'
      - name: Install Yarn dependencies
        run: yarn install --frozen-lockfile --ignore-engines
      - name: Build assets for Development
        run: npm run production
      - name: Create deployment package
        run: |
          # Clean any prior
          rm -rf deployment-package || true
          # Create isolated temp dir
          TEMP_DIR=$(mktemp -d)
          # Sync repo files to temp (exclusions prevent bloat/self-ref)
          rsync -av \
            --exclude=node_modules \
            --exclude=.git \
            --exclude=.github \
            --exclude=tests \
            --exclude=storage/logs \
            --exclude=vendor \
            . "$TEMP_DIR/"
          # Copy assets into temp/public/ (these are already built via npm run production)
          cp -r public/css public/js public/fonts public/images public/svg public/mix-manifest.json "$TEMP_DIR/public/" || true
          # Rename to package name
          mv "$TEMP_DIR" deployment-package
      - name: Upload deployment artifact
        uses: actions/upload-artifact@v4
        with:
          name: digitizationacademy-${{ github.sha }}
          path: deployment-package/
          retention-days: 30
      - name: Deploy with Deployer
        uses: deployphp/action@v1
        with:
          private-key: ${{ secrets.DEPLOY_PRIVATE_KEY }}
          dep: deploy development
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_SHA: ${{ github.sha }}
          GITHUB_REPO: ${{ github.repository }}
          OPCACHE_WEBHOOK_TOKEN: ${{ secrets.OPCACHE_WEBHOOK_TOKEN }}
      - name: Revoke Runner IP from AWS Security Group
        if: always()
        run: |
          aws ec2 revoke-security-group-ingress \
            --region ${{ secrets.AWS_REGION }} \
            --group-id ${{ secrets.AWS_SECURITY_GROUP_ID }} \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32