deploy.yml

name: Release and deploy to Render

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

concurrency:
  group: deploy
  cancel-in-progress: true

permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}/northwoods

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    strategy:
      matrix:
        include:
          - name: api
            dockerfile: src/Services/Northwoods.Api/Dockerfile
            context: .
            render_service_id: srv-d73ber19fqoc73ci2l60
          - name: worker
            dockerfile: src/Workers/Extraction.Worker/Dockerfile
            context: src/
            render_service_id: srv-d73bervkijhs73dee48g
          - name: web
            dockerfile: apps/web/Dockerfile
            context: .
            render_service_id: srv-d73bhic2kvos738c3t6g
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v7
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64
          push: true
          tags: ${{ env.IMAGE_PREFIX }}-${{ matrix.name }}:latest,${{ env.IMAGE_PREFIX }}-${{ matrix.name }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Update Render service image
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
        run: |
          IMAGE="${{ env.IMAGE_PREFIX }}-${{ matrix.name }}:latest"
          echo "Updating ${{ matrix.render_service_id }} to $IMAGE"
          # Render credential rgc-d73tmlnfte5s73b88010 handles ghcr.io auth
          curl -sf -X PATCH \
            "https://api.render.com/v1/services/${{ matrix.render_service_id }}" \
            -H "Authorization: Bearer $RENDER_API_KEY" \
            -H "Content-Type: application/json" \
            -d "{\"image\": {\"imagePath\": \"$IMAGE\", \"registryCredentialId\": \"rgc-d73tmlnfte5s73b88010\"}}" \
            | jq -r '.name // "updated"'

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Render deploys
        env:
          RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
        run: |
          for SVC in srv-d73ber19fqoc73ci2l60 srv-d73bervkijhs73dee48g srv-d73bhic2kvos738c3t6g; do
            echo "Deploying $SVC..."
            curl -sf -X POST "https://api.render.com/v1/services/$SVC/deploys" \
              -H "Authorization: Bearer $RENDER_API_KEY" \
              -H "Content-Type: application/json" \
              -d '{"clearCache":"do_not_clear"}' \
              | jq -r '.id // "triggered"'
          done
      - name: Verify deploys triggered
        run: echo "Deploys triggered. Render free tier may take 5-10 minutes. Check https://dashboard.render.com"

  smoke-test:
    needs: deploy
    runs-on: ubuntu-latest
    permissions:
      contents: read
    # Give Render free-tier services time to spin up after deploy
    steps:
      - uses: actions/checkout@v4

      - name: Wait for services to start
        run: |
          echo "Waiting for service to be ready..."
          for i in $(seq 1 30); do
            if curl -sf --max-time 5 "https://northwoods.muness.com/" > /dev/null 2>&1; then
              echo "Service ready after $((i * 10)) seconds"
              exit 0
            fi
            sleep 10
          done
          echo "Service did not become ready within 300 seconds"
          exit 1

      - name: Run production smoke test
        env:
          SMOKE_BASE_URL: https://northwoods.muness.com
          SMOKE_WORKER_EMAIL: ${{ secrets.SMOKE_WORKER_EMAIL }}
          SMOKE_WORKER_PASSWORD: ${{ secrets.SMOKE_WORKER_PASSWORD }}
          SMOKE_REVIEWER_EMAIL: ${{ secrets.SMOKE_REVIEWER_EMAIL }}
          SMOKE_REVIEWER_PASSWORD: ${{ secrets.SMOKE_REVIEWER_PASSWORD }}
        run: bash scripts/production-smoke.sh


  release:
    needs: smoke-test
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: Release ${{ github.ref_name }}
          generate_release_notes: true
          make_latest: true
          allowUpdates: true