deploy-gcp.yml

name: Deploy to GCP VM

on:
  workflow_dispatch:
    inputs:
      reason:
        description: "Deployment reason (optional)"
        required: false
        type: string
  push:
    branches: [main]
    paths:
      - backend/**
      - frontend/**
      - orchestrator/**
      - stt-service/**
      - nmt-service/**
      - tts-service/**
      - media-service/**
      - libs/dablja-worker/**
      - libs/dablja-segments/**
      - libs/docker-torch/**
      - docker-compose.microservices.prod.yml
      - docker-compose.microservices.gpu.yml
      - docker-compose.gpu.yml
      - docker-compose.observability.yml
      - infra/terraform/**
      - infra/observability/**
      - infra/rabbitmq/enabled_plugins
      - infra/scripts/deploy-production.sh
      - infra/scripts/validate-gpu-deploy.sh
      - infra/scripts/lib/**
      - infra/terraform/env-production.gpu.snippet
      - .env.production.example
      - Caddyfile.production
      - .github/workflows/deploy-gcp.yml

permissions:
  contents: read

concurrency:
  group: production-deploy
  # Never cancel an in-progress deployment — a cancelled deploy mid-run can
  # leave the VM in a partial state (some containers on new images, others not,
  # migrations half-applied). Subsequent runs queue instead of clobbering.
  cancel-in-progress: false

jobs:
  deploy:
    name: deploy-gcp
    runs-on: ubuntu-latest
    timeout-minutes: 120
    environment: production
    env:
      TARGET_BRANCH: main
      APP_DIR: ~/web
      ENV_FILE: .env.production
      BOOTSTRAP_MARKER: /var/lib/vm-bootstrap.done
      REQUIRE_BOOTSTRAP_MARKER: "true"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure SSH
        env:
          VM_HOST: ${{ secrets.GCP_VM_HOST }}
          VM_USER: ${{ secrets.GCP_VM_USER }}
          VM_PORT: ${{ secrets.GCP_VM_PORT }}
          VM_SSH_KEY: ${{ secrets.GCP_VM_SSH_KEY }}
        run: |
          set -euo pipefail

          if [ -z "$VM_HOST" ] || [ -z "$VM_USER" ] || [ -z "$VM_SSH_KEY" ]; then
            echo "Missing required secrets: GCP_VM_HOST, GCP_VM_USER, GCP_VM_SSH_KEY"
            exit 1
          fi

          VM_PORT="${VM_PORT:-22}"

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$VM_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -p "$VM_PORT" -H "$VM_HOST" >> ~/.ssh/known_hosts

      - name: Deploy on VM
        env:
          VM_HOST: ${{ secrets.GCP_VM_HOST }}
          VM_USER: ${{ secrets.GCP_VM_USER }}
          VM_PORT: ${{ secrets.GCP_VM_PORT }}
          TARGET_BRANCH: ${{ env.TARGET_BRANCH }}
          APP_DIR: ${{ env.APP_DIR }}
          ENV_FILE: ${{ env.ENV_FILE }}
          BOOTSTRAP_MARKER: ${{ env.BOOTSTRAP_MARKER }}
          REQUIRE_BOOTSTRAP_MARKER: ${{ env.REQUIRE_BOOTSTRAP_MARKER }}
          DEPLOY_SHA: ${{ github.sha }}
          DEPLOY_REASON: ${{ github.event.inputs.reason || github.event.head_commit.message || 'push' }}
          REPO_SSH_URL: ${{ secrets.GIT_REPO_SSH_URL }}
          REPO_FALLBACK: git@github.com:${{ github.repository }}.git
        run: |
          set -euo pipefail
          VM_PORT="${VM_PORT:-22}"

          # Pipe git-sync helpers then deploy script — on first boot the repo is not
          # on the VM yet, so the runner checkout is the only source for these files.
          {
            cat infra/scripts/lib/git-sync.sh
            cat infra/scripts/deploy-production.sh
          } | ssh -p "$VM_PORT" "$VM_USER@$VM_HOST" env \
            "TARGET_BRANCH=$(printf '%q' "$TARGET_BRANCH")" \
            "APP_DIR=$(printf '%q' "$APP_DIR")" \
            "ENV_FILE=$(printf '%q' "$ENV_FILE")" \
            "BOOTSTRAP_MARKER=$(printf '%q' "$BOOTSTRAP_MARKER")" \
            "REQUIRE_BOOTSTRAP_MARKER=$(printf '%q' "$REQUIRE_BOOTSTRAP_MARKER")" \
            "DEPLOY_SHA=$(printf '%q' "$DEPLOY_SHA")" \
            "DEPLOY_REASON=$(printf '%q' "$DEPLOY_REASON")" \
            "REPO_SSH_URL=$(printf '%q' "$REPO_SSH_URL")" \
            "REPO_FALLBACK=$(printf '%q' "$REPO_FALLBACK")" \
            bash -s

      - name: GPU deploy smoke (optional)
        if: success()
        env:
          VM_HOST: ${{ secrets.GCP_VM_HOST }}
          VM_USER: ${{ secrets.GCP_VM_USER }}
          VM_PORT: ${{ secrets.GCP_VM_PORT }}
          GCP_GPU_ENABLED: ${{ secrets.GCP_GPU_ENABLED }}
        run: |
          set -euo pipefail
          if [ "${GCP_GPU_ENABLED:-}" != "true" ]; then
            echo "Skipping GPU smoke (set repository secret GCP_GPU_ENABLED=true to enable)"
            exit 0
          fi
          VM_PORT="${VM_PORT:-22}"
          GPU_SMOKE_LOG="$(mktemp)"
          ssh -p "$VM_PORT" "$VM_USER@$VM_HOST" bash -se <<'REMOTE_EOF' | tee "$GPU_SMOKE_LOG"
          set -euo pipefail
          cd "$HOME/web"
          bash infra/scripts/validate-gpu-deploy.sh || true
          REMOTE_EOF
          {
            echo "### GPU smoke (optional)"
            echo ""
            if grep -q 'GPU validation passed' "$GPU_SMOKE_LOG"; then
              echo "- Status: passed"
            elif grep -q 'GPU validation completed with warnings' "$GPU_SMOKE_LOG"; then
              echo "- Status: warnings (deploy not failed — lenient policy)"
            else
              echo "- Status: incomplete or skipped"
            fi
            if grep -q 'COMPOSE_ENABLE_GPU is not true' "$GPU_SMOKE_LOG"; then
              echo "- Warning: \`COMPOSE_ENABLE_GPU\` is not true in VM \`.env.production\`"
            fi
            if grep -q 'STT service reports CPU device' "$GPU_SMOKE_LOG"; then
              echo "- Warning: STT service is on CPU"
            fi
            if grep -q 'TTS service reports torch.cuda.is_available()=False' "$GPU_SMOKE_LOG"; then
              echo "- Warning: TTS service does not see CUDA"
            fi
            echo ""
            echo "<details><summary>Full GPU smoke log</summary>"
            echo ""
            echo '```'
            cat "$GPU_SMOKE_LOG"
            echo '```'
            echo "</details>"
          } >> "$GITHUB_STEP_SUMMARY"
          rm -f "$GPU_SMOKE_LOG"

      - name: Deployment summary
        if: always()
        env:
          DEPLOY_STATUS: ${{ job.status }}
          VM_HOST: ${{ secrets.GCP_VM_HOST }}
          VM_USER: ${{ secrets.GCP_VM_USER }}
          VM_PORT: ${{ secrets.GCP_VM_PORT }}
        run: |
          GPU_OVERLAY_STATUS="unknown"
          if [ -n "${VM_HOST:-}" ] && [ -n "${VM_USER:-}" ]; then
            VM_PORT="${VM_PORT:-22}"
            GPU_OVERLAY_STATUS="$(ssh -p "$VM_PORT" -o ConnectTimeout=10 "$VM_USER@$VM_HOST" \
              "grep -E '^COMPOSE_ENABLE_GPU=' \"\$HOME/web/.env.production\" 2>/dev/null | tail -1 || echo 'COMPOSE_ENABLE_GPU not set'" \
              2>/dev/null || echo 'unavailable (SSH failed)')"
          fi
          {
            if [ "$DEPLOY_STATUS" = "success" ]; then
              echo "## ✅ Production Deployment Succeeded"
            else
              echo "## ❌ Production Deployment Failed"
            fi
            echo ""
            echo "| Field | Value |"
            echo "|-------|-------|"
            echo "| Workflow | deploy-gcp |"
            echo "| Trigger | ${{ github.event_name }} |"
            echo "| Repository SHA | \`${{ github.sha }}\` |"
            echo "| Target branch | \`${{ env.TARGET_BRANCH }}\` |"
            echo "| Target VM path | \`${{ env.APP_DIR }}\` |"
            echo "| Compose file | \`docker-compose.microservices.prod.yml\` + optional GPU (\`COMPOSE_ENABLE_GPU\`) / observability (\`COMPOSE_PROFILES=observability\`) overlays |"
            echo "| GPU overlay (VM env) | \`${GPU_OVERLAY_STATUS}\` |"
            echo "| GPU smoke | optional — set repo secret \`GCP_GPU_ENABLED=true\` (warn-only; does not fail deploy) |"
            echo "| Deploy script | \`infra/scripts/deploy-production.sh\` |"
            echo "| Deploy log on VM | \`${{ env.APP_DIR }}/deploy.log\` |"
            echo "| Grafana (when enabled) | \`https://grafana.\$DOMAIN\` — see VM \`.env.production\` |"
            echo ""
            echo "> Timing breakdown (frontend_build / compose_up / health_gates) is emitted"
            echo "> to the VM deploy log: \`tail -20 ~/web/deploy.log\`"
          } >> "$GITHUB_STEP_SUMMARY"