test_and_deploy.yml

name: Test & Deploy

on: [push, workflow_dispatch]

env:
  FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

jobs:
  test_back:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Setup timezone
        uses: zcong1993/setup-timezone@master
        with:
          timezone: Europe/Paris

      - name: Install api deps
        run: |
          cd run
          npm install

      - name: Run api tests
        run: |
          cd run
          npm run test tests/

      - name: Install pm2 server deps
        run: |
          cd pm2-server
          npm install

      - name: Run pm2 server tests
        run: |
          cd pm2-server
          npm run test

  test_front:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Setup timezone
        uses: zcong1993/setup-timezone@master
        with:
          timezone: Europe/Paris

      - name: Install deps
        run: yarn

      - name: Run tests
        run: yarn test tests/unit
        env:
          VITE_ENABLE_BILLING: true
          VITE_MAIN_DOMAIN: ethernal.local:8080
          VITE_ENABLE_DEMO: true

  create_release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [test_front, test_back]
    runs-on: ubuntu-latest
    outputs:
      current_version: ${{ steps.get_changelog.outputs.version }}
      changes: ${{ steps.get_changelog.outputs.changes }}
      release_name: ${{ steps.get_release.outputs.release_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Get tag
        id: get_tag
        run: echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Get release name
        id: get_release
        run: echo "release_name=ethernal@${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Get Changelog Entry
        id: get_changelog
        uses: mindsers/changelog-reader-action@v2
        with:
          validation_depth: 10
          version: ${{ steps.get_tag.outputs.current_version }}

      - name: Create Release
        uses: ncipollo/release-action@v1
        with:
          body: ${{ steps.get_changelog.outputs.changes }}
          tag: ${{ steps.get_changelog.outputs.version }}
          token: ${{ secrets.GITHUB_TOKEN }}

  run_migrations:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [create_release]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Install deps
        run: cd run && npm install

      # Pinned to a SHA, not @master: FLY_API_TOKEN is set at workflow level, so
      # every job here hands the production Fly credential to whatever that
      # branch happens to point at today. This SHA is what v1/1.6 resolve to.
      - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6

      # The database has no public address. Since the move to Fly it is reachable
      # only on Fly's private IPv6 network, so a runner cannot dial it by any
      # hostname — it has to come in over WireGuard. The tunnel and the migration
      # share one step so the proxy's lifetime is unambiguous.
      #
      # Connects to the pgbouncer flycast address rather than a database machine
      # directly: pgbouncer already tracks whichever machine is primary, so this
      # keeps working across a failover or a rebuilt machine, neither of which
      # keeps its address.
      - name: Run migrations
        run: |
          nohup flyctl proxy 15432:5432 ethernal-pgbouncer.flycast \
            -a ethernal-pgbouncer > /tmp/flyproxy.log 2>&1 &

          for i in $(seq 1 30); do
            (echo > /dev/tcp/127.0.0.1/15432) >/dev/null 2>&1 && break
            if [ "$i" = "30" ]; then
              echo "::error::Tunnel to ethernal-pgbouncer never came up"
              cat /tmp/flyproxy.log
              exit 1
            fi
            sleep 1
          done

          cd run && npx sequelize db:migrate --env migration
        env:
          # Not secrets: the tunnel endpoint is local to the runner. The
          # `ethernal_migrations` database is the same database as `ethernal`,
          # pooled per session instead of per transaction — migrations hold
          # session state, and CONCURRENT index builds cannot run in a
          # transaction at all.
          DB_HOST: 127.0.0.1
          DB_PORT: 15432
          DB_NAME: ethernal_migrations
          DB_USER: ${{ secrets.DB_USER }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

  deploy_caddy:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [create_release, run_migrations]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v3

      # Pinned to a SHA, not @master: FLY_API_TOKEN is set at workflow level, so
      # every job here hands the production Fly credential to whatever that
      # branch happens to point at today. This SHA is what v1/1.6 resolve to.
      - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6

      - name: Deploy Caddy
        run: |
          flyctl deploy -c fly.caddy.toml \
            --build-arg VITE_SENTRY_DSN_SECRET=${{ secrets.VITE_SENTRY_DSN_SECRET }} \
            --build-arg VITE_SENTRY_DSN_PROJECT_ID=${{ secrets.VITE_SENTRY_DSN_PROJECT_ID }} \
            --build-arg VITE_SENTRY_AUTH_TOKEN=${{ secrets.VITE_SENTRY_AUTH_TOKEN }} \
            --build-arg VITE_SENTRY_ORG=${{ secrets.VITE_SENTRY_ORG }} \
            --build-arg VITE_SENTRY_PROJECT=${{ secrets.VITE_SENTRY_PROJECT }} \
            --build-arg VITE_SENTRY_URL=${{ secrets.VITE_SENTRY_URL }} \
            --build-arg VITE_SENTRY_ENABLED=${{ secrets.VITE_SENTRY_ENABLED }} \
            --build-arg VITE_SOKETI_KEY=${{ secrets.SOKETI_DEFAULT_APP_KEY }}

  deploy_back_amd64:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [create_release, run_migrations]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v3

      - name: Setup credentials
        run: |
          echo "$GCLOUD_CREDENTIALS" >> ethernal-95a14-19f78a7e26cc.json
        shell: bash
        env:
          GCLOUD_CREDENTIALS: ${{ secrets.GCLOUD_CREDENTIALS }}

      # Pinned to a SHA, not @master: FLY_API_TOKEN is set at workflow level, so
      # every job here hands the production Fly credential to whatever that
      # branch happens to point at today. This SHA is what v1/1.6 resolve to.
      - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6

      - name: Setup Docker Buildx
        run: |
          docker buildx create --use
          docker buildx inspect --bootstrap
        shell: bash

      - name: Log in to Docker Hub
        run: |
          echo "${{ secrets.DOCKERHUB_PASSWORD }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin

      - name: Build & push backend image
        run: |
          flyctl auth docker
          ./build-prod-images-amd64.sh ${{ needs.create_release.outputs.current_version }}

  deploy_back_arm64:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [create_release, run_migrations]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v3

      # Pinned to a SHA, not @master: FLY_API_TOKEN is set at workflow level, so
      # every job here hands the production Fly credential to whatever that
      # branch happens to point at today. This SHA is what v1/1.6 resolve to.
      - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6

      - name: Setup Docker Buildx
        run: |
          docker buildx create --use
          docker buildx inspect --bootstrap
        shell: bash

      - name: Log in to Docker Hub
        run: |
          echo "${{ secrets.DOCKERHUB_PASSWORD }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin

      - name: Build & push backend image
        run: |
          flyctl auth docker
          ./build-prod-images-arm64.sh ${{ needs.create_release.outputs.current_version }}

  release_back:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [deploy_back_amd64, create_release]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v3

      # Pinned to a SHA, not @master: FLY_API_TOKEN is set at workflow level, so
      # every job here hands the production Fly credential to whatever that
      # branch happens to point at today. This SHA is what v1/1.6 resolve to.
      - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6

      - name: Update version
        run: |
          flyctl secrets set VERSION=${{ needs.create_release.outputs.current_version }} --stage -a ethernal
          flyctl secrets set VERSION=${{ needs.create_release.outputs.current_version }} --stage -a ethernal-pm2

      - name: Release backend
        run: flyctl deploy -c fly.toml -i registry.fly.io/ethernal:${{ needs.create_release.outputs.current_version }}

      - name: Release PM2 server
        run: flyctl deploy -c fly.pm2.toml -i registry.fly.io/ethernal-pm2:${{ needs.create_release.outputs.current_version }}

      - name: Release Soketi server
        run: flyctl deploy -c fly.soketi.toml