deploy-on-merge.yml

name: Deploy on Merge (optional)

# This workflow performs an optional SSH/SCP deploy when code is merged to `main`.
# It only runs the deploy step if the required secrets are provided in the repository:
# - DEPLOY_HOST
# - DEPLOY_USER
# - DEPLOY_SSH_KEY
# - DEPLOY_TARGET
# - DEPLOY_PORT (optional, defaults to 22)
#
# To enable: add the above secrets in GitHub → Settings → Secrets → Actions.

on:
  push:
    branches:
      - main

jobs:
  build:
    name: Build / Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'

      - name: Install deps (if any)
        run: |
          python -m pip install --upgrade pip
          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

      - name: Run quick tests (if pytest)
        run: |
          if command -v pytest >/dev/null 2>&1; then pytest -q || true; fi

  deploy:
    name: Deploy (conditional)
    runs-on: ubuntu-latest
    needs: build
    env:
      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
      DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
      DEPLOY_TARGET: ${{ secrets.DEPLOY_TARGET }}
      DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check deploy secrets
        id: check-secrets
        run: |
          if [ -n "$DEPLOY_HOST" ] && [ -n "$DEPLOY_SSH_KEY" ]; then
            echo "has_secrets=true" >> $GITHUB_OUTPUT
          else
            echo "has_secrets=false" >> $GITHUB_OUTPUT
          fi

      - name: Prepare SSH key
        if: steps.check-secrets.outputs.has_secrets == 'true'
        run: |
          mkdir -p ~/.ssh
          echo "$DEPLOY_SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa

      - name: Ensure known_hosts (optional)
        if: steps.check-secrets.outputs.has_secrets == 'true'
        run: |
          PORT="${DEPLOY_PORT:-22}"
          ssh-keyscan -p "$PORT" -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts || true

      - name: Copy files to target via scp
        if: steps.check-secrets.outputs.has_secrets == 'true'
        run: |
          PORT="${DEPLOY_PORT:-22}"
          echo "Deploying to $DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_TARGET (port $PORT) using rsync with .deployignore"
          # Prefer using .deployignore in repo root to control excludes.
          if [ -f .deployignore ]; then
            rsync -az --delete --exclude-from='.deployignore' -e "ssh -p $PORT -o StrictHostKeyChecking=yes" . "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_TARGET"
          else
            echo ".deployignore not found, using conservative inline excludes"
            rsync -az --delete \
              --exclude='.git' \
              --exclude='.env' \
              --exclude='*.env' \
              --exclude='venv/' \
              --exclude='.venv/' \
              --exclude='env/' \
              --exclude='__pycache__/' \
              --exclude='*.pyc' \
              --exclude='local_markets_db/' \
              --exclude='*.sqlite' \
              --exclude='*.db' \
              --exclude='logs/' \
              -e "ssh -p $PORT -o StrictHostKeyChecking=yes" . "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_TARGET"
          fi