cd-ec2.yml

name: CD (EC2)

on:
  workflow_run:
    workflows: ["CI"]
    types:
      - completed
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: deploy-production-ec2
  cancel-in-progress: false

jobs:
  deploy:
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    environment:
      name: production

    steps:
      - name: Validate required secrets
        env:
          EC2_HOST: ${{ secrets.EC2_HOST }}
          EC2_USER: ${{ secrets.EC2_USER }}
          EC2_SSH_PRIVATE_KEY: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
          EC2_DEPLOY_PATH: ${{ secrets.EC2_DEPLOY_PATH }}
        run: |
          set -euo pipefail
          for name in EC2_HOST EC2_USER EC2_SSH_PRIVATE_KEY EC2_DEPLOY_PATH; do
            if [ -z "${!name}" ]; then
              echo "Missing required secret: $name"
              exit 1
            fi
          done

      - name: Configure SSH
        env:
          EC2_HOST: ${{ secrets.EC2_HOST }}
          EC2_PORT: ${{ secrets.EC2_PORT }}
          EC2_SSH_PRIVATE_KEY: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          PORT="${EC2_PORT:-22}"
          mkdir -p "$HOME/.ssh"
          chmod 700 "$HOME/.ssh"
          printf "%s\n" "$EC2_SSH_PRIVATE_KEY" > "$HOME/.ssh/id_deploy"
          chmod 600 "$HOME/.ssh/id_deploy"
          ssh-keyscan -p "$PORT" -H "$EC2_HOST" >> "$HOME/.ssh/known_hosts"
          chmod 644 "$HOME/.ssh/known_hosts"

      - name: Deploy to EC2
        env:
          EC2_HOST: ${{ secrets.EC2_HOST }}
          EC2_PORT: ${{ secrets.EC2_PORT }}
          EC2_USER: ${{ secrets.EC2_USER }}
          EC2_DEPLOY_PATH: ${{ secrets.EC2_DEPLOY_PATH }}
        run: |
          set -euo pipefail
          PORT="${EC2_PORT:-22}"
          ssh -i "$HOME/.ssh/id_deploy" -p "$PORT" -o StrictHostKeyChecking=yes "${EC2_USER}@${EC2_HOST}" "bash -s" <<EOF
            set -euo pipefail
            cd "${EC2_DEPLOY_PATH}"

            git fetch --prune origin
            git checkout master
            git pull --ff-only origin master

            docker compose -f docker-compose.prod.yml up -d --build redis web
            docker compose -f docker-compose.prod.yml exec -T web python manage.py migrate --noinput
            docker compose -f docker-compose.prod.yml ps
          EOF