deploy-firebase.yml

name: Deploy to Firebase
on:
  workflow_dispatch:
    inputs:
      environment:
        description: "Environment to deploy to"
        type: choice # type: environment
        required: true
        default: staging
        options:
          - production
          - staging
          - development
  # Auto trigger on version tags (e.g., v1.2.3 or v1.2.3-beta.1)
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+" # e.g., v1.2.3 (release)
      - "v[0-9]+.[0-9]+.[0-9]+-[A-Za-z]+.[0-9]+" # e.g., v1.2.3-beta.1 (pre-release)

concurrency:
  group: ${{ github.workflow }}-${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && 'live' ||
    startsWith(github.ref, 'refs/tags/v') && contains(github.ref_name, '-') && 'staging' || inputs.environment ||
    'staging' }}
  cancel-in-progress: true

permissions:
  contents: read # Allows fetching repository contents (for checkout)
  actions: read # Minimal permissions for GitHub Actions
  checks: write # Allow posting check results (if needed for status)

env:
  FLUTTER_CHANNEL: "stable" # master / dev / beta / stable (default)
  FLUTTER_VERSION: "3.41.7" # 3.38.0 / '' (default)
  SENTRY_PROJECT: "auth-app"
  FIREBASE_PROJECT_ID: "zs-auth-app"
  FIREBASE_TOOLS_VERSION: "15.15.0"

jobs:
  build_and_deploy_web:
    name: Build & Deploy Flutter Web
    runs-on: ubuntu-latest
    # needs: [lint, test] TODO
    container:
      image: plugfox/flutter:${{ vars.FLUTTER_VERSION || '3.41.7' }}-web
    if: github.actor != 'dependabot[bot]' && (github.ref_name == 'main' || github.ref_name == 'v3' || github.ref_name ==
      'dev' || startsWith(github.ref, 'refs/tags'))
    timeout-minutes: 30
    env:
      # Persist PUB_CACHE path. GitLab can use: ${{ github.workspace }}/.pub-cache
      PUB_CACHE: /var/cache/pub
      # Environment
      ENV: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') && 'production' ||
        startsWith(github.ref, 'refs/tags/v') && contains(github.ref_name, '-') && 'staging' ||
        github.event.inputs.environment }}

    steps:
      - name: ✨ Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0 # Fetch full git history for Sentry release identification

      - name: 🔐 Validate environment configuration
        run: |
          flutter --version
          if [ ! -f "config/${{ env.ENV }}.env" ]; then
            echo "❌ Environment file config/${{ env.ENV }}.env not found!"
            exit 1
          fi
          echo "✅ ${{ env.ENV }} environment"

      - name: 📦 Cache Flutter Pub packages
        uses: actions/cache@v5
        with:
          path: /var/cache/pub # GitLab: .pub-cache
          key: flutter-pub-${{ hashFiles('pubspec.lock') }}
          restore-keys: |
            flutter-pub-

      - name: 🔒 Configure Git safe directory
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: 🐳 Build Flutter Web
        run: bash deploy/build_flutter_web.sh
        env:
          APP_ENVIRONMENT: ${{ env.ENV }}
          GIT_SHA: ${{ github.sha }}
          S3_URL: ${{ secrets.S3_URL }}
          # OAI_KEY: ${{ secrets.OAI_KEY }}
          # WHISPER_ADDRESS: ${{ secrets.WHISPER_ADDRESS }}
          # SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          # SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          # SENTRY_PROJECT: ${{ env.SENTRY_PROJECT }}
          # SENTRY_ENVIRONMENT: ${{ env.ENV }}
          # SENTRY_RELEASE: ${{ github.sha }}

      - name: 📦 Upload build artifacts
        if: success() && env.ENV == 'production'
        uses: actions/upload-artifact@v6
        with:
          name: web-build-${{ env.ENV }}-${{ github.sha }}
          path: build/web/
          retention-days: 7

      - name: 🟢 Install Node.js 24.x # for Firebase CLI
        if: success()
        uses: actions/setup-node@v6 # bundles npm & npx
        with:
          node-version: 24

      - name: 🔐 Authenticate to Google Cloud
        if: success()
        uses: google-github-actions/auth@v3
        with:
          credentials_json: "${{ secrets.FIREBASE_SERVICE_ACCOUNT_ZS_AUTH_APP }}"

      - name: ☁ Deploy to Firebase
        if: success()
        id: firebase_deploy
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${ENV}" == "production" ]]; then
            npx "firebase-tools@${FIREBASE_TOOLS_VERSION}" \
              deploy \
              --only hosting \
              --project "${FIREBASE_PROJECT_ID}" \
              --json >/tmp/firebase-deploy.json

            {
              echo "details_url=https://${FIREBASE_PROJECT_ID}.web.app/"
              echo "expire_time="
              echo "expire_time_formatted="
            } >> "$GITHUB_OUTPUT"
          else
            npx "firebase-tools@${FIREBASE_TOOLS_VERSION}" \
              hosting:channel:deploy "${ENV}" \
              --expires 30d \
              --project "${FIREBASE_PROJECT_ID}" \
              --json >/tmp/firebase-deploy.json

            # Parse preview channel deployment result
            node -e '
              const fs = require("fs");
              const raw = fs.readFileSync("/tmp/firebase-deploy.json", "utf8");
              const deployment = JSON.parse(raw);
              const results = Object.values(deployment.result ?? {});
              if (results.length === 0) throw new Error("Firebase preview deploy returned no hosting results.");
              const { expireTime = "", url: detailsUrl = "" } = results[0];
              const expireTimeFormatted = expireTime ? new Date(expireTime).toUTCString() : "";
              const output = process.env.GITHUB_OUTPUT;
              fs.appendFileSync(output, `details_url=${detailsUrl}\n`);
              fs.appendFileSync(output, `expire_time=${expireTime}\n`);
              fs.appendFileSync(output, `expire_time_formatted=${expireTimeFormatted}\n`);
            '
          fi

      - name: 🚀 Deployment Summary
        if: always()
        run: |
          {
            echo "### 🚀 Deployment Summary"
            echo ""
            echo "**Environment:** ${{ env.ENV }}"
            echo "**URL:** ${{ steps.firebase_deploy.outputs.details_url || 'N/A' }}"
            echo "**Expires:** ${{ steps.firebase_deploy.outputs.expire_time || 'Never' }}"
            echo ""
            echo "**Commit:** ${{ github.sha }}"
            echo "**Branch/Tag:** ${{ github.ref_name }}"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: 📢 Send deployment notification
        if: success() && env.ENV == 'production'
        run: |
          echo "Production deployment completed successfully!"
          # Slack/Discord/Email notification here if needed