deploy.yml

name: deploy

on:
  workflow_call:
    inputs:
      channel:
        description: 'Deploy target (main or canary)'
        required: true
        type: string
      deploy_title:
        description: 'Dokploy deployment title (e.g. triggering commit subject)'
        required: false
        type: string
        default: ''
      deploy_version:
        description: 'App version baked into the image (without v prefix)'
        required: false
        type: string
        default: ''
      deploy_description:
        description: 'Dokploy deployment description (e.g. version tag)'
        required: false
        type: string
        default: ''
  workflow_dispatch:
    inputs:
      channel:
        description: 'Deploy target (main or canary); leave empty to auto-detect'
        required: false
        type: string
        default: ''
      deploy_title:
        description: 'Dokploy deployment title'
        required: false
        type: string
        default: ''
      deploy_version:
        description: 'App version baked into the image (without v prefix)'
        required: false
        type: string
        default: ''
      deploy_description:
        description: 'Dokploy deployment description'
        required: false
        type: string
        default: ''

jobs:
  resolve:
    runs-on: ubuntu-latest
    outputs:
      channel: ${{ steps.meta.outputs.channel }}
      environment_url: ${{ steps.meta.outputs.environment_url }}

    steps:
      - name: Checkout repository
        if: inputs.channel == ''
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve deploy channel
        id: meta
        run: |
          CHANNEL="${{ inputs.channel }}"
          if [[ -z "$CHANNEL" ]]; then
            REF="${GITHUB_REF#refs/heads/}"
            if [[ "$REF" == "main" || "$REF" == "canary" ]]; then
              CHANNEL="$REF"
            else
              git fetch origin main canary
              SHA="${{ github.sha }}"
              MAIN_HEAD=$(git rev-parse origin/main)
              CANARY_HEAD=$(git rev-parse origin/canary)
              if [[ "$SHA" == "$MAIN_HEAD" ]]; then
                CHANNEL=main
              elif [[ "$SHA" == "$CANARY_HEAD" ]]; then
                CHANNEL=canary
              elif git branch -r --contains "$SHA" | grep -qE 'origin/canary$'; then
                CHANNEL=canary
              elif git branch -r --contains "$SHA" | grep -qE 'origin/main$'; then
                CHANNEL=main
              else
                echo "Could not resolve deploy channel" >&2
                exit 1
              fi
            fi
          fi
          if [[ "$CHANNEL" != "main" && "$CHANNEL" != "canary" ]]; then
            echo "Invalid channel: $CHANNEL" >&2
            exit 1
          fi

          case "$CHANNEL" in
            main)   ENVIRONMENT_URL="https://pfcontrol.com" ;;
            canary) ENVIRONMENT_URL="https://canary.pfcontrol.com" ;;
          esac

          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
          echo "environment_url=$ENVIRONMENT_URL" >> "$GITHUB_OUTPUT"
          echo "Deploying to $CHANNEL ($ENVIRONMENT_URL)"

  deploy:
    needs: resolve
    runs-on: ubuntu-latest
    permissions:
      contents: read
      deployments: write

    environment:
      name: ${{ needs.resolve.outputs.channel }}
      url: ${{ needs.resolve.outputs.environment_url }}

    steps:
      - name: Configure Dokploy app version
        if: inputs.deploy_version != ''
        env:
          DEPLOY_VERSION: ${{ inputs.deploy_version }}
        run: |
          case "${{ needs.resolve.outputs.channel }}" in
            canary) APP_ID="IIakyrrLChtjnjuKKVFiB" ;;
            main)   APP_ID="C4Vzp1quDF4mKt2AQPjkU" ;;
            *)
              echo "Unknown channel: ${{ needs.resolve.outputs.channel }}" >&2
              exit 1
              ;;
          esac

          API_BASE="https://${{ secrets.DOKPLOY_HOST }}/api"
          AUTH=(-H "x-api-key: ${{ secrets.DOKPLOY_API_TOKEN }}")

          APP_JSON=$(curl -fsS "${API_BASE}/application.one?applicationId=${APP_ID}" "${AUTH[@]}")

          # Runtime env (syncVersionFromEnv) and Docker build-args (ARG APP_VERSION) must both be set;
          # Dokploy does not pass application env into docker build (see dokploy/dokploy#1244).
          CURRENT_ENV=$(echo "$APP_JSON" | jq -r '.env // ""')
          NEW_ENV=$(printf '%s\n' "$CURRENT_ENV" | grep -v '^APP_VERSION=' | sed '/^$/d')
          NEW_ENV="${NEW_ENV}"$'\n'"APP_VERSION=${DEPLOY_VERSION}"

          CURRENT_ARGS=$(echo "$APP_JSON" | jq -r '.buildArgs // ""')
          NEW_ARGS=$(printf '%s\n' "$CURRENT_ARGS" | grep -v '^APP_VERSION=' | sed '/^$/d')
          NEW_ARGS="${NEW_ARGS}"$'\n'"APP_VERSION=${DEPLOY_VERSION}"

          PAYLOAD=$(echo "$APP_JSON" | jq \
            --arg applicationId "$APP_ID" \
            --arg env "$NEW_ENV" \
            --arg buildArgs "$NEW_ARGS" \
            '{
              applicationId: $applicationId,
              env: $env,
              buildArgs: $buildArgs,
              buildSecrets: (.buildSecrets // ""),
              createEnvFile: (.createEnvFile // true)
            }')

          curl -fsS -X POST "${API_BASE}/application.saveEnvironment" \
            "${AUTH[@]}" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"

          echo "Configured APP_VERSION=${DEPLOY_VERSION} for ${{ needs.resolve.outputs.channel }}"

      - name: Trigger Dokploy deploy
        env:
          DEPLOY_TITLE: ${{ inputs.deploy_title }}
          DEPLOY_DESCRIPTION: ${{ inputs.deploy_description }}
        run: |
          case "${{ needs.resolve.outputs.channel }}" in
            canary) APP_ID="IIakyrrLChtjnjuKKVFiB" ;;
            main)   APP_ID="C4Vzp1quDF4mKt2AQPjkU" ;;
            *)
              echo "Unknown channel: ${{ needs.resolve.outputs.channel }}" >&2
              exit 1
              ;;
          esac

          PAYLOAD=$(jq -n \
            --arg applicationId "$APP_ID" \
            --arg title "$DEPLOY_TITLE" \
            --arg description "$DEPLOY_DESCRIPTION" \
            '{applicationId: $applicationId}
             + (if ($title | length) > 0 then {title: $title} else {} end)
             + (if ($description | length) > 0 then {description: $description} else {} end)')

          curl -fsS -X POST "https://${{ secrets.DOKPLOY_HOST }}/api/application.deploy" \
            -H "x-api-key: ${{ secrets.DOKPLOY_API_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"