cd.yml

name: CD

on:
  push:
    branches: [main]
    tags:
      - "v*"
  workflow_dispatch:

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: cd-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality-frontend:
    name: Frontend Quality
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint:ci

      - name: Build
        run: npm run build

  quality-backend:
    name: Backend Quality
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: test1234
          MYSQL_DATABASE: smalltrend_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    env:
      DB_URL: jdbc:mysql://localhost:3306/smalltrend_test?allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC&createDatabaseIfNotExist=true
      DB_USERNAME: root
      DB_PASSWORD: test1234
      JWT_SECRET: 5367566B59703373367639792F423F4528482B4D6251655468576D5A71347437
      CLOUDINARY_CLOUD_NAME: ci_dummy
      CLOUDINARY_API_KEY: "000000000000000"
      CLOUDINARY_API_SECRET: ci_dummy_secret
      SPRING_SQL_INIT_MODE: never
      SPRING_JPA_DDL_AUTO: create-drop
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          java-version: "17"
          distribution: temurin
          cache: maven

      - name: Make Maven wrapper executable
        run: chmod +x mvnw

      - name: Build jar (skip tests)
        run: ./mvnw -B clean package -Dmaven.test.skip=true

  docker:
    name: Build And Push Images
    runs-on: ubuntu-latest
    needs: [quality-frontend, quality-backend]
    permissions:
      contents: read
      packages: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Backend image metadata
        id: backend-meta
        uses: docker/metadata-action@v5
        with:
          images: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/smalltrend-backend
          tags: |
            type=raw,value=latest
            type=sha,format=long
            type=ref,event=tag

      - name: Build and push backend image
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          file: ./backend/Dockerfile
          push: true
          tags: ${{ steps.backend-meta.outputs.tags }}
          labels: ${{ steps.backend-meta.outputs.labels }}

      - name: Frontend image metadata
        id: frontend-meta
        uses: docker/metadata-action@v5
        with:
          images: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/smalltrend-frontend
          tags: |
            type=raw,value=latest
            type=sha,format=long
            type=ref,event=tag

      - name: Build and push frontend image
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          file: ./frontend/Dockerfile
          push: true
          build-args: |
            VITE_API_BASE_URL=/api
          tags: ${{ steps.frontend-meta.outputs.tags }}
          labels: ${{ steps.frontend-meta.outputs.labels }}

  deploy:
    name: Deploy To Azure VM
    runs-on: ubuntu-latest
    needs: [docker]
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
    steps:
      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.2.0
        env:
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          IMAGE_TAG: sha-${{ github.sha }}
          PREVIOUS_IMAGE_TAG: sha-${{ github.event.before }}
          HEALTHCHECK_URL: ${{ secrets.HEALTHCHECK_URL }}
          MIGRATION_COMMAND: ${{ secrets.MIGRATION_COMMAND }}
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT || 22 }}
          envs: DEPLOY_PATH,DOCKERHUB_USERNAME,DOCKERHUB_TOKEN,IMAGE_TAG,PREVIOUS_IMAGE_TAG,HEALTHCHECK_URL,MIGRATION_COMMAND
          script: |
            set -eu
            cd "$DEPLOY_PATH"
            ENV_FILE="./deploy/env/backend.env"

            # Keep VM source scripts in sync with latest main before running any local script.
            if [ -d .git ]; then
              git config --global --add safe.directory "$DEPLOY_PATH" || true
              sudo git config --system --add safe.directory "$DEPLOY_PATH" || true

              # Always sync with sudo git to avoid permission issues on root-owned .git.
              # Preserve local VM edits in a stash, then force working tree to origin/main.
              if ! sudo git -C "$DEPLOY_PATH" diff --quiet || ! sudo git -C "$DEPLOY_PATH" diff --cached --quiet; then
                STASH_NAME="auto-deploy-$(date +%s)"
                echo "Local changes detected on VM. Stashing as: $STASH_NAME"
                sudo git -C "$DEPLOY_PATH" stash push -u -m "$STASH_NAME" || true
              fi

              sudo git -C "$DEPLOY_PATH" fetch origin
              sudo git -C "$DEPLOY_PATH" checkout main
              sudo git -C "$DEPLOY_PATH" reset --hard origin/main
            fi

            if [ ! -f "$ENV_FILE" ]; then
              echo "Missing required file: $ENV_FILE"
              exit 1
            fi

            if [ ! -r "$ENV_FILE" ]; then
              echo "No read permission for $ENV_FILE, loading via sudo..."
            fi

            # Read only required keys from backend.env (safe, no shell execution).
            get_env_value() {
              key="$1"
              sudo sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1 | tr -d '\r'
            }

            DB_USERNAME="$(get_env_value DB_USERNAME)"
            DB_PASSWORD="$(get_env_value DB_PASSWORD)"
            MYSQL_DATABASE="$(get_env_value MYSQL_DATABASE)"
            MYSQL_ROOT_PASSWORD="$(get_env_value MYSQL_ROOT_PASSWORD)"
            DB_URL_FROM_ENV="$(get_env_value DB_URL)"
            SPRING_SQL_INIT_MODE="$(get_env_value SPRING_SQL_INIT_MODE)"
            SPRING_JPA_DDL_AUTO="$(get_env_value SPRING_JPA_DDL_AUTO)"

            : "${DB_USERNAME:=smalltrend}"
            : "${DB_PASSWORD:=1234}"
            : "${MYSQL_DATABASE:=smalltrend}"
            : "${MYSQL_ROOT_PASSWORD:=root1234}"
            : "${SPRING_SQL_INIT_MODE:=never}"
            : "${SPRING_JPA_DDL_AUTO:=update}"

            CANONICAL_DB_URL="jdbc:mysql://mysql:3306/${MYSQL_DATABASE}?allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC&createDatabaseIfNotExist=true&useUnicode=true&characterEncoding=UTF-8"
            DB_URL="$CANONICAL_DB_URL"

            if [ -n "$DB_URL_FROM_ENV" ] && [[ "$DB_URL_FROM_ENV" == *"mysql:3306"* ]] && [[ "$DB_URL_FROM_ENV" == *"/${MYSQL_DATABASE}"* ]]; then
              DB_URL="$DB_URL_FROM_ENV"
            elif [ -n "$DB_URL_FROM_ENV" ]; then
              echo "WARNING: backend.env DB_URL is not container-safe. Overriding with docker-internal DB_URL."
              echo "backend.env DB_URL=$DB_URL_FROM_ENV"
            fi

            # Prevent false-positive seed checks when backend points to a different DB/schema.
            if [[ "$DB_URL" != *"mysql:3306"* ]]; then
              echo "ERROR: DB_URL must point to mysql service in docker compose (mysql:3306)."
              echo "Current DB_URL: $DB_URL"
              exit 1
            fi

            if [[ "$DB_URL" != *"/${MYSQL_DATABASE}"* ]]; then
              echo "ERROR: DB_URL database does not match MYSQL_DATABASE."
              echo "MYSQL_DATABASE=$MYSQL_DATABASE"
              echo "DB_URL=$DB_URL"
              exit 1
            fi

            compose_cmd() {
              sudo env \
                REGISTRY="$REGISTRY" \
                IMAGE_NAMESPACE="$IMAGE_NAMESPACE" \
                IMAGE_TAG="$TARGET_TAG" \
                DB_URL="$DB_URL" \
                DB_USERNAME="$DB_USERNAME" \
                DB_PASSWORD="$DB_PASSWORD" \
                MYSQL_DATABASE="$MYSQL_DATABASE" \
                MYSQL_ROOT_PASSWORD="$MYSQL_ROOT_PASSWORD" \
                SPRING_SQL_INIT_MODE="$SPRING_SQL_INIT_MODE" \
                SPRING_JPA_DDL_AUTO="$SPRING_JPA_DDL_AUTO" \
                docker compose -f docker-compose.prod.yml "$@"
            }

            echo "$DOCKERHUB_TOKEN" | sudo docker login -u "$DOCKERHUB_USERNAME" --password-stdin

            REGISTRY=docker.io
            IMAGE_NAMESPACE="$DOCKERHUB_USERNAME"
            TARGET_TAG="$IMAGE_TAG"
            FALLBACK_TAG="latest"

            image_exists() {
              sudo docker manifest inspect "$1" > /dev/null 2>&1
            }

            verify_tag_exists() {
              tag="$1"
              image_exists "$REGISTRY/$IMAGE_NAMESPACE/smalltrend-backend:$tag" && \
                image_exists "$REGISTRY/$IMAGE_NAMESPACE/smalltrend-frontend:$tag"
            }

            deploy_tag() {
              tag="$1"
              echo "Deploying tag: $tag"
              TARGET_TAG="$tag"
              compose_cmd pull
              compose_cmd up -d --remove-orphans
            }

            if ! verify_tag_exists "$TARGET_TAG"; then
              echo "ERROR: Required image tag $TARGET_TAG not found for backend/frontend."
              echo "Refusing to deploy fallback tag to avoid artifact drift."
              exit 1
            fi

            deploy_tag "$TARGET_TAG"

            if [ -n "$MIGRATION_COMMAND" ]; then
              eval "$MIGRATION_COMMAND"
            fi

            # Auto-bootstrap seed when DB is empty (prevents blank app after deploy/reset).
            get_table_count() {
              table="$1"
              compose_cmd exec -T mysql \
                mysql -N -s -uroot -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE" -e "SELECT COUNT(*) FROM $table;" 2>/dev/null | tr -d '\r'
            }

            get_scalar_value() {
              sql="$1"
              compose_cmd exec -T mysql \
                mysql -N -s -uroot -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE" -e "$sql" 2>/dev/null | tr -d '\r'
            }

            refresh_integrity_metrics() {
              JOINABLE_VARIANTS_COUNT="$(get_scalar_value "SELECT COUNT(*) FROM product_variants pv LEFT JOIN products p ON p.id = pv.product_id LEFT JOIN units u ON u.id = pv.unit_id WHERE p.id IS NOT NULL AND u.id IS NOT NULL;" || echo 0)"
              ORPHAN_PRODUCT_REFS="$(get_scalar_value "SELECT COUNT(*) FROM product_variants pv LEFT JOIN products p ON p.id = pv.product_id WHERE p.id IS NULL;" || echo 0)"
              ORPHAN_UNIT_REFS="$(get_scalar_value "SELECT COUNT(*) FROM product_variants pv LEFT JOIN units u ON u.id = pv.unit_id WHERE u.id IS NULL;" || echo 0)"
              STOCKED_VARIANTS_COUNT="$(get_scalar_value "SELECT COUNT(DISTINCT variant_id) FROM inventory_stock WHERE COALESCE(quantity, 0) > 0;" || echo 0)"
            }

            is_integrity_bad() {
              stock_count="$1"
              if [ "${JOINABLE_VARIANTS_COUNT:-0}" = "0" ]; then
                return 0
              fi
              if [ "${ORPHAN_PRODUCT_REFS:-0}" != "0" ] || [ "${ORPHAN_UNIT_REFS:-0}" != "0" ]; then
                return 0
              fi
              if [ "${stock_count:-0}" != "0" ] && [ "${STOCKED_VARIANTS_COUNT:-0}" = "0" ]; then
                return 0
              fi
              return 1
            }

            PRODUCTS_COUNT="$(get_table_count products || echo 0)"
            VARIANTS_COUNT="$(get_table_count product_variants || echo 0)"
            STOCK_COUNT="$(get_table_count inventory_stock || echo 0)"
            SALE_ORDERS_COUNT="$(get_table_count sale_orders || echo 0)"
            SALE_ORDER_ITEMS_COUNT="$(get_table_count sale_order_items || echo 0)"
            TICKETS_COUNT="$(get_table_count tickets || echo 0)"
            LOYALTY_GIFTS_COUNT="$(get_table_count loyalty_gifts || echo 0)"
            refresh_integrity_metrics
            SEED_WAS_RUN=0

            echo "Post-deploy counts: products=$PRODUCTS_COUNT, variants=$VARIANTS_COUNT, inventory_stock=$STOCK_COUNT, sale_orders=$SALE_ORDERS_COUNT, sale_order_items=$SALE_ORDER_ITEMS_COUNT, tickets=$TICKETS_COUNT, loyalty_gifts=$LOYALTY_GIFTS_COUNT"
            echo "Post-deploy integrity: joinable_variants=$JOINABLE_VARIANTS_COUNT, orphan_product_refs=$ORPHAN_PRODUCT_REFS, orphan_unit_refs=$ORPHAN_UNIT_REFS, stocked_variants=$STOCKED_VARIANTS_COUNT"

            if [ "${PRODUCTS_COUNT:-0}" = "0" ] || [ "${VARIANTS_COUNT:-0}" = "0" ] || [ "${STOCK_COUNT:-0}" = "0" ] || [ "${SALE_ORDERS_COUNT:-0}" = "0" ] || [ "${SALE_ORDER_ITEMS_COUNT:-0}" = "0" ] || [ "${TICKETS_COUNT:-0}" = "0" ] || [ "${LOYALTY_GIFTS_COUNT:-0}" = "0" ] || is_integrity_bad "$STOCK_COUNT"; then
              echo "Detected empty or inconsistent critical product data. Running reset-db-and-seed.sh..."
              if [ -f "./deploy/scripts/reset-db-and-seed.sh" ]; then
                sudo chmod +x ./deploy/scripts/reset-db-and-seed.sh
                sudo DEPLOY_PATH="$DEPLOY_PATH" COMPOSE_FILE="$DEPLOY_PATH/docker-compose.prod.yml" ENV_FILE="$ENV_FILE" SEED_STRATEGY="fix-only" bash ./deploy/scripts/reset-db-and-seed.sh
                SEED_WAS_RUN=1
                # Ensure services are up after seed
                compose_cmd up -d --remove-orphans
              else
                echo "Seed script not found: ./deploy/scripts/reset-db-and-seed.sh"
              fi
            fi

            PRODUCTS_COUNT_FINAL="$(get_table_count products || echo 0)"
            VARIANTS_COUNT_FINAL="$(get_table_count product_variants || echo 0)"
            STOCK_COUNT_FINAL="$(get_table_count inventory_stock || echo 0)"
            SALE_ORDERS_COUNT_FINAL="$(get_table_count sale_orders || echo 0)"
            SALE_ORDER_ITEMS_COUNT_FINAL="$(get_table_count sale_order_items || echo 0)"
            TICKETS_COUNT_FINAL="$(get_table_count tickets || echo 0)"
            LOYALTY_GIFTS_COUNT_FINAL="$(get_table_count loyalty_gifts || echo 0)"
            refresh_integrity_metrics
            echo "Post-start final counts: products=$PRODUCTS_COUNT_FINAL, variants=$VARIANTS_COUNT_FINAL, inventory_stock=$STOCK_COUNT_FINAL, sale_orders=$SALE_ORDERS_COUNT_FINAL, sale_order_items=$SALE_ORDER_ITEMS_COUNT_FINAL, tickets=$TICKETS_COUNT_FINAL, loyalty_gifts=$LOYALTY_GIFTS_COUNT_FINAL"
            echo "Post-start final integrity: joinable_variants=$JOINABLE_VARIANTS_COUNT, orphan_product_refs=$ORPHAN_PRODUCT_REFS, orphan_unit_refs=$ORPHAN_UNIT_REFS, stocked_variants=$STOCKED_VARIANTS_COUNT"

            if [ "${PRODUCTS_COUNT_FINAL:-0}" = "0" ] || [ "${VARIANTS_COUNT_FINAL:-0}" = "0" ] || [ "${STOCK_COUNT_FINAL:-0}" = "0" ] || [ "${SALE_ORDERS_COUNT_FINAL:-0}" = "0" ] || [ "${SALE_ORDER_ITEMS_COUNT_FINAL:-0}" = "0" ] || [ "${TICKETS_COUNT_FINAL:-0}" = "0" ] || [ "${LOYALTY_GIFTS_COUNT_FINAL:-0}" = "0" ] || is_integrity_bad "$STOCK_COUNT_FINAL"; then
              echo "ERROR: Critical seed data is still inconsistent after deploy + seed."
              echo "Diagnostics: products=$PRODUCTS_COUNT_FINAL, variants=$VARIANTS_COUNT_FINAL, stock=$STOCK_COUNT_FINAL, sale_orders=$SALE_ORDERS_COUNT_FINAL, sale_order_items=$SALE_ORDER_ITEMS_COUNT_FINAL, tickets=$TICKETS_COUNT_FINAL, loyalty_gifts=$LOYALTY_GIFTS_COUNT_FINAL, joinable_variants=$JOINABLE_VARIANTS_COUNT, orphan_product_refs=$ORPHAN_PRODUCT_REFS, orphan_unit_refs=$ORPHAN_UNIT_REFS, stocked_variants=$STOCKED_VARIANTS_COUNT"
              compose_cmd logs --tail=150 mysql backend || true
              exit 1
            fi

            # Runtime verification for freshly-seeded environments.
            if [ "$SEED_WAS_RUN" = "1" ]; then
              LOGIN_URL="http://127.0.0.1:8081/api/auth/login"
              VARIANTS_URL="http://127.0.0.1:8081/api/products/variants"

              VERIFY_LOGIN_MAX_RETRIES=24
              VERIFY_LOGIN_RETRY_DELAY=5
              VERIFY_LOGIN_ATTEMPT=1
              LOGIN_RESPONSE=""
              ACCESS_TOKEN=""

              while [ "$VERIFY_LOGIN_ATTEMPT" -le "$VERIFY_LOGIN_MAX_RETRIES" ]; do
                LOGIN_RESPONSE="$(curl -fsS --max-time 10 -H "Content-Type: application/json" -d '{"username":"admin","password":"password"}' "$LOGIN_URL" || true)"
                ACCESS_TOKEN="$(printf '%s' "$LOGIN_RESPONSE" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')"

                if [ -n "$ACCESS_TOKEN" ]; then
                  break
                fi

                echo "Login API not ready (attempt $VERIFY_LOGIN_ATTEMPT/$VERIFY_LOGIN_MAX_RETRIES). Retrying in ${VERIFY_LOGIN_RETRY_DELAY}s..."
                sleep "$VERIFY_LOGIN_RETRY_DELAY"
                VERIFY_LOGIN_ATTEMPT=$((VERIFY_LOGIN_ATTEMPT + 1))
              done

              if [ -z "$ACCESS_TOKEN" ]; then
                echo "ERROR: Runtime API verification failed at login step after retries."
                echo "Last login response: $LOGIN_RESPONSE"
                compose_cmd logs --tail=150 backend || true
                exit 1
              fi

              VERIFY_VARIANTS_MAX_RETRIES=12
              VERIFY_VARIANTS_RETRY_DELAY=5
              VERIFY_VARIANTS_ATTEMPT=1
              VARIANTS_RESPONSE=""
              VARIANTS_API_COUNT=0

              while [ "$VERIFY_VARIANTS_ATTEMPT" -le "$VERIFY_VARIANTS_MAX_RETRIES" ]; do
                VARIANTS_RESPONSE="$(curl -fsS --max-time 10 -H "Authorization: Bearer $ACCESS_TOKEN" "$VARIANTS_URL" || true)"
                VARIANTS_API_COUNT="$(printf '%s' "$VARIANTS_RESPONSE" | grep -Eo '"id"[[:space:]]*:[[:space:]]*[0-9]+' | wc -l | tr -d ' ')"
                : "${VARIANTS_API_COUNT:=0}"

                if [ "${VARIANTS_API_COUNT:-0}" != "0" ]; then
                  break
                fi

                echo "Variants API empty/not ready (attempt $VERIFY_VARIANTS_ATTEMPT/$VERIFY_VARIANTS_MAX_RETRIES). Retrying in ${VERIFY_VARIANTS_RETRY_DELAY}s..."
                sleep "$VERIFY_VARIANTS_RETRY_DELAY"
                VERIFY_VARIANTS_ATTEMPT=$((VERIFY_VARIANTS_ATTEMPT + 1))
              done

              echo "Runtime API variants count: $VARIANTS_API_COUNT"

              if [ "${VARIANTS_API_COUNT:-0}" = "0" ]; then
                echo "ERROR: /api/products/variants returned empty response after deployment."
                echo "Last variants response: $VARIANTS_RESPONSE"

                UNITS_COUNT="$(get_table_count units || echo 0)"
                ACTIVE_VARIANTS_DB_COUNT="$(compose_cmd exec -T mysql mysql -N -s -uroot -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE" -e "SELECT COUNT(*) FROM product_variants WHERE is_active = 1;" 2>/dev/null | tr -d '\r' || echo 0)"
                JOINABLE_VARIANTS_DB_COUNT="$(compose_cmd exec -T mysql mysql -N -s -uroot -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE" -e "SELECT COUNT(*) FROM product_variants pv LEFT JOIN products p ON p.id = pv.product_id LEFT JOIN units u ON u.id = pv.unit_id WHERE p.id IS NOT NULL AND u.id IS NOT NULL;" 2>/dev/null | tr -d '\r' || echo 0)"

                echo "Diagnostics: units=$UNITS_COUNT, active_variants=$ACTIVE_VARIANTS_DB_COUNT, joinable_variants=$JOINABLE_VARIANTS_DB_COUNT"
                compose_cmd logs --tail=150 backend || true
                exit 1
              fi
            else
              echo "Skipping seeded-login API verification because DB was not reset in this deployment."
            fi

            MAX_RETRIES=12
            RETRY_DELAY=10
            ATTEMPT=1
            HEALTHY=0

            while [ "$ATTEMPT" -le "$MAX_RETRIES" ]; do
              if curl -fsS "$HEALTHCHECK_URL" > /dev/null; then
                HEALTHY=1
                break
              fi
              echo "Healthcheck failed (attempt $ATTEMPT/$MAX_RETRIES). Retrying in ${RETRY_DELAY}s..."
              sleep "$RETRY_DELAY"
              ATTEMPT=$((ATTEMPT + 1))
            done

            if [ "$HEALTHY" -ne 1 ]; then
              echo "Healthcheck failed after deployment. Showing service status and logs..."
              compose_cmd ps
              compose_cmd logs --tail=120 mysql backend frontend || true

              ROLLBACK_TAG=""
              if [ -n "$PREVIOUS_IMAGE_TAG" ] && [ "$PREVIOUS_IMAGE_TAG" != "sha-0000000000000000000000000000000000000000" ] && verify_tag_exists "$PREVIOUS_IMAGE_TAG"; then
                ROLLBACK_TAG="$PREVIOUS_IMAGE_TAG"
              elif verify_tag_exists "$FALLBACK_TAG"; then
                ROLLBACK_TAG="$FALLBACK_TAG"
              fi

              if [ -n "$ROLLBACK_TAG" ]; then
                echo "Rolling back to $ROLLBACK_TAG"
                deploy_tag "$ROLLBACK_TAG"
              else
                echo "No valid rollback tag found. Leaving current state for investigation."
              fi

              exit 1
            fi

            echo "Deployment successful with tag: $TARGET_TAG"